Service Location Protocol vulnerability

Langenhagen, Germany, 28 April, 2023

On April 25, researchers at Bitsight and Curesec released an article about a vulnerability they had discovered, which allowed them to abuse the Service Location Protocol (SLP) and carry out an amplified DDoS (Distributed Denial of Service) attack.

While SLP is not intended to be utilized via the internet, the researchers were able to locate internet exposed devices that have the SLP service enabled and thus could be exploited in order to carry out the attack on other victim computers/servers.

In their article, the researchers also mention that a number of vulnerable Konica Minolta devices were identified. Internet exposed devices that are acting as Service Agents are at risk of being exploited in order for the attack to be carried out on other victims. Konica Minolta recommends the following measures to mitigate the potential risk:
 

• To protect against CVE-2023-29552, SLP should be disabled on all systems running on untrusted networks, like those directly connected to the Internet.
• If that is not possible, firewalls should be configured to filter traffic on UDP and TCP port 427.
• In our Office Printing and Production Printing devices, the “SLP Setting” can usually be configured via Network Settings within the Administrator mode. The setting can be accessed via the MFP panel, PageScope Web Connection or Remote Panel.

Please find more information about the vulnerability and mitigation instructions here: Security Advice