Langenhagen, Germany, 28 April, 2023
On April 25, researchers at Bitsight and Curesec released an article about a vulnerability they had discovered, which allowed them to abuse the Service Location Protocol (SLP) and carry out an amplified DDoS (Distributed Denial of Service) attack.
While SLP is not intended to be utilized via the internet, the researchers were able to locate internet exposed devices that have the SLP service enabled and thus could be exploited in order to carry out the attack on other victim computers/servers.
In their article, the researchers also mention that a number of vulnerable Konica Minolta devices were identified. Internet exposed devices that are acting as Service Agents are at risk of being exploited in order for the attack to be carried out on other victims. Konica Minolta recommends the following measures to mitigate the potential risk:
Please find more information about the vulnerability and mitigation instructions here: Security Advice