{
  "port": 427,
  "protocol": "both",
  "service": "SLP (Service Location Protocol)",
  "oneLiner": "Service Location Protocol — VMware ESXi, printers, and SAN gear advertising what they offer, and a serious DDoS reflector.",
  "whatItIs": "SLP (RFC 2608) lets user agents discover services without configuration: agents multicast or unicast service requests to 427 and service agents reply with URLs, optionally through a directory agent that aggregates registrations. It shipped enabled by default on VMware ESXi, on network printers, on NetApp's SMI-S provider and on SUSE systems, which is why it still appears on scans of datacenter networks. Two things made it notorious: CVE-2021-21974, the ESXi OpenSLP heap overflow that the ESXiArgs ransomware campaign exploited at scale, and CVE-2023-29552, which lets an attacker register services and then reflect spoofed UDP at up to roughly 2,200x amplification.",
  "exposure": {
    "verdict": "never",
    "note": "CISA added CVE-2023-29552 to its Known Exploited Vulnerabilities catalog and its required action is to disable SLP or block 427/UDP on anything reachable from an untrusted network."
  },
  "checkCommand": "nmap -sU -p 427 --script srvloc TARGET",
  "links": [
    {
      "title": "RFC 2608 — Service Location Protocol, Version 2",
      "url": "https://www.rfc-editor.org/rfc/rfc2608.html",
      "kind": "spec"
    },
    {
      "title": "CVE-2023-29552 — SLP reflective denial-of-service amplification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29552",
      "kind": "official-docs"
    },
    {
      "title": "CVE-2021-21974 — ESXi OpenSLP heap overflow (the ESXiArgs vector)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21974",
      "kind": "official-docs"
    },
    {
      "title": "openslp-org/openslp — the reference SLP implementation",
      "url": "https://github.com/openslp-org/openslp",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 427",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=427",
      "kind": "iana"
    }
  ],
  "ianaName": "svrloc"
}