SLP discovered a vulnerability in the old protocol that could lead to the amplification of large-scale DDoS attacks. Vulnerability CVE-2023-29552 (https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp) allows attackers to register services on SLP to the server and increase the size of UDP-packets by filling the buffer. Thus, the request can be expanded 2,200 times, turning a tiny packet into a massive response.
In other words, the old SLP has the potential to amplify the largest DDoS attack with minimal resources. Researchers have counted ~54 thousand vulnerable devices in 2 thousand organizations, and they are the same as SLP. The release of ESXi with the end of general support, routers from Planex, IMM from IBM… Somewhere in the Urals, there is an old office printer from Konica Minolta and still does not know that it can not only chew paper, but also hit with a powerful DDoS attack.
