AMI MegaRAC SPx 12 (Service Location Protocol service): Every BMC running SLP is a free DDoS cannon pointed

Impact

Every BMC running SLP is a free DDoS cannon pointed at the internet, with an amplification factor reported above 2000x. The damage is usually reputational and contractual before it is technical: your management subnet starts sourcing multi-gigabit reflected floods, upstream transit providers null-route you, and the abuse tickets land on the operator. Secondary effect is that the BMC's own control plane saturates, so you lose out-of-band management of the affected nodes exactly when you need it. CISA has this in the Known Exploited Vulnerabilities catalog - it is being used in the wild, not theoretically.

Who can reach it

Unauthenticated UDP to the SLP service on the BMC. Dangerous specifically where BMC management interfaces have been given routable or internet-reachable addresses, which happens more often than operators admit in leased colo, in early-stage neocloud builds, and on remote edge racks reached over a public IP.

What to do

Config-only, no flash, no reboot - and it is one of the few in this cluster you can fix today. Disable SLP on the BMC (AMI ships it disabled on SPx_12 fixed builds and SPx_13 does not support it at all), and block UDP/427 inbound at the edge. Then do the structural fix: get BMC interfaces off any publicly routable address and behind a VPN or bastion. Verify by scanning your own management ranges from outside, because operators routinely discover BMCs they did not know were exposed.

References