Cyber Resilience

CVE-2023-29552

Suse Linux Enterprise Server 11 … 15

CISA KEVActive ExploitationEUVD ExploitedPublic PoC
Published
25 April 2023
Modified
31 October 2025
KEV Added
08 November 2023
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.66 99.2th percentile
Risk Priority 84 floored blend · peak EPSS

Summary

CVE-2023-29552 is a high-severity an unspecified weakness vulnerability in Suse Linux Enterprise Server. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability CVE-2023-29552 resides in the Service Location Protocol (SLP) defined by RFC 2608. It stems from the protocol's acceptance of service registrations without authentication, enabling attackers to leverage implementations in products such as those from VMware and NetApp. The flaw produces a reflected denial-of-service condition with a high amplification factor when combined with spoofed UDP traffic.

An unauthenticated remote attacker can exploit the issue by sending crafted registration messages that elicit amplified responses directed at a target. This allows the adversary to conduct volumetric DoS attacks that consume bandwidth and resources on victim systems without requiring prior access or credentials.

VMware and NetApp advisories, along with Curesec analysis, address mitigation steps for affected SLP deployments. Public references also include the original RFC 2608 specification and a proof-of-concept tool released on GitHub.

The associated EPSS score has remained elevated, reaching a peak of 0.9296.

EU & UK References

Vulnerability Data

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

CWE(s)
KEV Date Added
08 November 2023

Related Threats

CVEs Like This One

CVE-2010-3904Same product: Suse Linux Enterprise Serverboth on KEV
CVE-2024-37085Same product: Vmware Esxiboth on KEV
CVE-2020-3992Same product: Vmware Esxiboth on KEV
CVE-2025-22225Same product: Vmware Esxiboth on KEV
CVE-2025-22224Same product: Vmware Esxiboth on KEV
CVE-2025-22226Same product: Vmware Esxiboth on KEV
CVE-2022-22948Same product class: hypervisor / virtualizationboth on KEV
CVE-2024-38813Same product class: hypervisor / virtualizationboth on KEV
CVE-2021-21973Same product class: hypervisor / virtualizationboth on KEV
CVE-2024-38812Same product class: hypervisor / virtualizationboth on KEV

Affected Assets

netapp
smi-s provider
all versions
suse
manager server
all versions
suse
linux enterprise server
11, 12, 15
vmware
esxi
≤ 7.0
service location protocol project
service location protocol
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References