The Broadband Guide
SG
search advanced

Vulnerable Ports

This list (a very small part of our SG Ports database) includes TCP/UDP ports currently tested by our Security Scanner, and corresponding potential security threats. We update the list on a regular basis, however if you feel we should add other port(s) to the list or modify their descriptions, please . Any feedback and suggestions can also be posted to our Security forum.

 1 |....| 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 |....| 55 
Port(s) Protocol Service Scan level Description
 2371 tcp hp-rda not scanned HP Remote Device Access (IANA official)
 2372 tcp,udp lanmessenger not scanned Buffer overflow in k9filter.exe in BlueCoat K9 Web Protection 3.2.36, and probably other versions before 3.2.44, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 2372.
References: [CVE-2007-1685] [OSVDB-37186] [BID-24373] [SECUNIA-25593]

LanMessenger (IANA official)
 2375 tcp docker not scanned A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface).
References: [CVE-2016-9223], [BID-95024], [EDB-42650]

Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container and use chroot to escape the container-jail.
References: [EDB-42356]

Docker REST API (IANA official)
 2376 tcp docker-s not scanned Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a Docker container with the '/' path mounted with read/write permissions on the host server that is running the Docker container. As the Docker container executes command as uid 0 it is honored by the host operating system allowing the attacker to edit/create files owned by root. This exploit abuses this to creates a cron job in the '/etc/cron.d/' path of the host server.
References: [EDB-42650]

Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container and use chroot to escape the container-jail.
References: [EDB-42356]

Docker REST API (ssl) (IANA official)
 2377 tcp swarm not scanned Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Docker information.
References: [CVE-2024-4159]

RPC interface for Docker Swarm (IANA official)
 2378 udp dali not scanned IANA registered for: DALI lighting control
 2379 tcp etcd-client not scanned KGS Go Server

IANA registered for: etcd client communication
 2380 tcp,udp applications not scanned Buffer overflow in the administration web server for GoodTech Telnet Server 4.0 and 5.0, and possibly all versions before 5.0.7, allows remote attackers to execute arbitrary code via a long string to port 2380.
References: [CVE-2005-0768]

IANA registered for: etcd server to server communication (TCP)
 2381 tcp,udp compaq-https not scanned HP Insight Manager default for Web server

IANA registered for: Compaq HTTPS
 2382 tcp,udp ms-olap3 not scanned Microsoft OLAP
 2383 tcp,udp ms-olap4 not scanned Microsoft OLAP
 2399 tcp,udp fmpro-fdal not scanned IANA registered for: FileMaker, Inc. - Data Access Layer
 2400 tcp,udp applications not scanned Battlecom, Homeworld 2

Portd trojan also uses this port (TCP).

Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.
References: [CVE-2011-0742], [BID-46024]

Heap-based buffer overflow in ZfHIPCND.exe in Novell Zenworks 7 Handheld Management (ZHM) allows remote attackers to execute arbitrary code via a crafted request to TCP port 2400.
References: [CVE-2010-4299] [SECUNIA-42130]

Port also IANA registered for OpEquus Server
 2401 tcp,udp cvspserver not scanned IANA registered for: cvspserver
 2402 tcp,udp taskmaster2000 not scanned TaskMaster 2000 Server
 2403 tcp,udp taskmaster2000 not scanned TaskMaster 2000 Web
 2404 tcp applications not scanned An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 1703, and SICAM AK 3. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode. A cold start might be required to recover the system, a Denial-of-Service Vulnerability.
References: [CVE-2016-7987], [BID-93832]

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on port 2404/TCP.
References: [CVE-2019-6831]

IANA registered for: IEC 60870-5-104 process control over IP (TCP/UDP)
 2407 tcp trojan Premium scan yoyo trojan

Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port (2407), which causes the server to crash.
References: [BID-2539], [CVE-2001-0392], [XFDB-6318]

Port is also IANA registered for Orion
 2408 tcp railgun-webaccl not scanned CloudFlare Railgun Web Acceleration Protocol [CloudFlare] (IANA official)
 2414 tcp trojans Premium scan VBS.Shania [Symantec-2004-020217-3141-99] (2004.02.02) - remote access trojan. Affects all current Windows versions, listens on port 2414.
 2418 tcp trojan Premium scan Backdoor.Intruzzo [Symantec-2002-051012-5520-99]
 2420 tcp,udp dslremote-mgmt not scanned Westell Remote Access (UDP)

IANA registered for: DSL Remote Management
 2422 udp games not scanned Scrabble Complete
 2424 udp games not scanned Scrabble Complete

KOFAX-SVR (TCP/UDP) [Steven_Kilby] (IANA official)
 2424 tcp applications not scanned OrientDB database listening for Binary client connections
 2425 tcp,udp fjitsuappmgr not scanned Telnet, IP Messenger for Windows
IANA registered for: Fujitsu App Manager
 2426 udp games not scanned Scrabble Complete
 2427 tcp,udp mgcp-gateway not scanned ShoreTel IP Telephony system uses the following ports:
2427 UDP - IP phones listening port
2727 UDP - switches listening port
5004 UDP - voice packets
5440 TCP - HTTP CSIS, 5440 UDP - Location Service Protocol
5441 UDP - ShoreSIP
5442, 5446 UDP - DRS
5443, 5444, 5445 UDP - Bandwidth Reservation Protocol
5447, 5449, 5469 TCP - CAS & web proxy
5555 TCP - Shoreline diagnostic port (ipbxctl –diag)

Media Gateway Control Protocol Gateway (IANA official)
 2432 tcp,udp codasrv not scanned codasrv
 2433 tcp,udp codasrv-se not scanned codasrv-se
 2442 tcp trojans Premium scan W32.Spybot.NYT [Symantec-2005-041715-4455-99] (2005.04.17) - worm with DDoS (distributed denial of service) and backdoor capabilities. Spreads through network shares, exploits multiple vulnerabilities, and opens a backdoor via IRC channels on port 2442/tcp.
 2444 tcp trojans Premium scan Backdoor.Delf [Symantec-2003-050207-0707-99] - remote access and keylogging trojan family of backdoors, affect Windows. Different varians listen to these TCP ports: 23, 2189,2444,27378.

Cisco Unified Communications Manager deployed in secure mode is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by CTLProvider.exe. By sending an overly long request to TCP port 2444, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the service to crash.
References: [CVE-2008-0027], [BID-27313]
 2447 tcp,udp ovwdb not scanned IANA registered for: OpenView NNM daemon
 2455 tcp,udp wago-io-system not scanned Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools. Specially crafted packets may also be sent to Port 2455/TCP/IP, used in Codesys management software, which may result in a denial-of-service condition of communications with commissioning and service tools.
References: [CVE-2018-8836], [BID-103726]

An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.
References: [CVE-2018-5459], [XFDB-139037]

IANA registered for: WAGO-IO-SYSTEM
 2459 tcp,udp xrpl not scanned IANA registered for: Community
 2463 tcp,udp lsi-raid-mgmt not scanned IANA registered for: LSI RAID Management
 2465 tcp,udp lbm not scanned Load Balance Management
 2466 tcp,udp lbf not scanned Load Balance Forwarding
 2479 tcp ssm-els Premium scan The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
References: [CVE-2012-2217]

SecurSight Event Logging Server (SSL) (TCP/UDP) (IANA official)
 2480 tcp,udp powerexchange not scanned OrientDB database listening for HTTP client connections (TCP)

IANA registered for: Informatica PowerExchange Listener
 2481 tcp,udp giop not scanned Oracle GIOP
 2482 tcp,udp giop-ssl not scanned Oracle GIOP SSL
 2483 tcp,udp ttc not scanned Oracle database listening for unsecure client connections to the listener, replaces port 1521

IANA registered for: Oracle TTC
 2484 tcp,udp ttc-ssl not scanned Oracle database listening for SSL client connections to the listener

IANA registered for: Oracle TTC SSL
 2485 tcp netobjects1 Premium scan Backdoor.Djump [Symantec-2003-090116-0418-99] (2003.09.01) - a trojan horse that opens TCP ports 21009 and 2485 on a computer

Port is also IANA registered for Net Objects1
 2486 tcp,udp netobjects2 not scanned Net Objects2
 2492 tcp,udp groove not scanned GROOVE
 2499 tcp,udp unicontrol not scanned gBox, CWShare
IANA registered for: UniControl
 2500 tcp,udp rtsserv Premium scan Numara Asset Manager Platform (AMP) uses the following ports:
1610 - primary AMP port
1611 - communication between console and master server
Other optional ports used by AMP:
1609 - used to calculate available bandwidth for transfer windows
1612 - used by the application kiosk feature
2500 - used for multicast data transfers to agents
5400 - used for remote control only
22,23,25,135-139,445 - used for auto discovery, SSH remote inventory scans, SMB remote inventory
161 - SNMP remote inventory scan
67-69 - relays can be used to avoid opening ports over the wan

IPContact

TheosMessenger, TheosNet-Admin uses these ports:
2500/tcp, 2501/tcp - listening for client connections
43047/tcp, 43048/tcp - service ports


Macromedia Sitespring 1.2.0 (277.1) using Sybase runtime engine 7.0.2.1480 allows remote attackers to cause a denial of service (crash) via a long malformed request to TCP port 2500, possibly triggering a buffer overflow.
References: [BID-5132], [CVE-2002-1026], [XFDB-9458]

IANA registered for: Resource Tracking system server
 2501 tcp,udp rtsclient not scanned TheosMessenger, TheosNet-Admin uses these ports:
2500/tcp, 2501/tcp - listening for client connections
43047/tcp, 43048/tcp - service ports




IANA registered for: Resource Tracking system client
 2506 tcp applications not scanned Jana Server is vulnerable to a denial of service attack. A remote attacker could send specially-crafted data to the http-server module listening on TCP port 2506 and the pna-proxy module listening on TCP port 1090 to cause the server to enter into an infinite loop.
References: [BID-11780], [XFDB-18308]

Port is also IANA registered for jbroker (TCP/UDP)
 2509 tcp games not scanned The Political Machine
 2512 tcp,udp citrixima not scanned Citrix IMA uses port 2512 TCP (IANA registered).

Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server), Access Essentials and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.
References: [CVE-2008-0356], [BID-27329]
 2513 tcp,udp citrixadmin not scanned Citrix Management Console uses port 2513 TCP. FMA based platforms 7.5 and later do not use the port.

Port is IANA registered for Citrix ADMIN

Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server), Access Essentials and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.
References: [CVE-2008-0356], [BID-27329]
 2517 tcp,udp call-sig-trans not scanned H.323 Annex E Call Control Signalling Transport (IANA official)
 2518 tcp,udp willy not scanned IANA registered for: Willy
 2525 tcp altsmtp Members scan Sometimes used as an alternate to port 25 SMTP (Simple Mail Transfer Protocol). This is useful as a dedicated port for VPN clients or for those who cannot directly send mail to a mail server outside of their ISP's network because of ISPs blocking port 25.

Backdoor.Rockse [Symantec-2003-050614-4623-99] (2005.05.06) - remote access trojan. Affects Windows, opens a server on port 2020 or 2525.

Backdoor.Berbew.R [Symantec-2005-051915-2101-99] (2005.05.19) - remote access trojan that steals passwords and opens backdoors on ports 2525/tcp and 4495/tcp.
 2532 tcp applications not scanned HP OpenView Network Node Manager (OV NNM) is vulnerable to a denial of service, caused by an error in the ovtopmd service. By sending an exit request (0x36) packet to TCP port 2532, a remote attacker could cause the ovtopmd service to terminate.
References: [CVE-2008-1853], [BID-28745]
 2535 tcp trojans Members scan W32.Beagle.W@mm [Symantec-2004-042617-0238-99] and W32.Beagle.X@mm [Symantec-2004-042815-2313-99] variants - mass mailing worm and backdoor trojan. Affects all current Windows versions, opens a backdoor (it listens on TCP port 2535) and attempts to spread through file-sharing networks.

Port 2556 was used by earlier variants of the worm, like W32.Beagle.M@mm [Symantec-2004-031310-3624-99] and W32.Beagle.N@mm [Symantec-2004-031508-5302-99].

Port is IANA assigned for MADCAP - Multicast Address Dynamic Client Allocation Protocol
 2536 tcp trojans Premium scan W32/Colevo@MM [Symantec-2003-062813-0620-99] (2003.06.28) - mass mailing worm which harvests MSN Messenger contact addresses with backdoor capability. It opens ports 1168-1170 and 2536.

Schneider Electric Accutech Manager is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to port 2536 of the RFManagerService, which could allow the attacker to view, add, modify or delete information in the back-end database.
References: [XFDB-90180]

Port is also IANA registered for:
2536/tcp - btpp2audctr1
 2537 tcp upgrade not scanned A vulnerability has been reported in Schneider Electric Accutech Manager, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within RFManagerService.exe when processing HTTP requests and can be exploited to cause a heap-based buffer overflow by sending a specially crafted GET request with more than 260 bytes to TCP port 2537.
References: [CVE-2013-0658], [SECUNIA-52034]

Upgrade Protocol (IANA official)
 2543 tcp,udp applications not scanned SIP
 2546 tcp,udp vytalvaultbrtp not scanned vytalvaultbrtp
 2547 tcp,udp vytalvaultvsmp not scanned vytalvaultvsmp
 2548 tcp,udp vytalvaultpipe not scanned vytalvaultpipe
 2555 tcp trojans Members scan Compaq WCP
Lion trojan, T0rn Rootkit
 2556 tcp trojans Members scan W32.Beagle.M@mm [Symantec-2004-031310-3624-99] - mass mailing worm and backdoor trojan, 03.13.2004. Affects all current Windows versions, opens a backdoor (it listens on TCP port 2556) and attempts to spread through file-sharing networks.

Port also used by other variants of the worm, like W32.Beagle.N@mm [Symantec-2004-031508-5302-99].
 2565 tcp trojan Premium scan Striker trojan
 2581 tcp,udp argis-te not scanned ARGIS TE
 2582 tcp,udp argis-ds not scanned ARGIS DS
 2583 tcp trojan Premium scan WinCrash 2 trojan
 2589 tcp trojan Premium scan Dagger
 2592 tcp,udp netrek not scanned Netrek network game
 2593 tcp,udp mns-mail not scanned RunUO—Ultima Online server

IANA registered for: MNS Mail Notice Service
 2595 tcp,udp worldfusion1 not scanned World Fusion 1
 2596 tcp,udp worldfusion2 not scanned World Fusion 2
 2598 tcp,udp citriximaclient not scanned Citrix NetScaler gateway XenDesktop/XenApp VDA uses port 2598 TCP/UDP for access to applications and virtual desktops by ICA/HDX with Session Reliability.

new ICA - when Session Reliability is enabled, TCP port 2598 replaces port 1494

IANA registered for: Citrix MA Client
 2599 tcp,udp snapd not scanned SonicWALL anti-spam traffic between Remote Analyzer (RA) and Control Center (CC)

IANA registered for: Snap Discovery
 2600 tcp trojan Premium scan Digital RootBeer
 2601 tcp,udp discp-client not scanned zebra vty
IANA registered for: discp client

McAfee Network Threat Behavior Analysis could allow a remote attacker from within the local network to gain elevated privileges on the system, caused by an error related to the default configuration in the Zebra service. By connecting to port 2601 with telnet, an attacker could exploit this vulnerability to gain unrestricted root access to the machine.
References: [XFDB-85937] [BID-61420]
 2602 tcp,udp discp-server not scanned RIPd vty
IANA registered for: discp server
 2606 tcp applications not scanned Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to upload arbitrary files, and execute arbitrary code, via directory traversal sequences in requests to TCP port 2606.
References: [CVE-2008-3685]

Heap-based buffer overflow in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to execute arbitrary code via crafted packet data to TCP port 2606.
References: [CVE-2008-3684] [SECUNIA-37070]

Dell Netmon (IANA official)
 2608 tcp wag-service not scanned Backdoor.Win32.Mazben.es / Unauthenticated Open Proxy - the malware listens on random TCP ports, known 2608, 6751, 3087, 5947. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
References: [MVID-2021-0377]

Wag Service (IANA official)
 2610 tcp,udp versa-tek not scanned TrackiT mobile device monitoring (TCP)

IANA registered for: VersaTek
 2611 tcp games not scanned Black and White
 2612 tcp,udp qpasa-agent not scanned Games: Black and White (TCP)

IANA registered for: Qpasa Agent
 2621 tcp,udp miles-apart not scanned Oracle Procedural Gateway
IANA registered for: Miles Apart Jukebox Server
 2627 tcp trojans Members scan Backdoor.Rallovs.B [Symantec-2012-011108-4024-99] (2012.01.10) - a trojan horse that opens a backdoor on TCP port 2627 on the compromised computer.

Port is also IANA registered for Moshe Beeri.
 2636 tcp,udp solve not scanned IANA registered for: Solve
 2638 udp applications not scanned CiscoWorks Common Services could allow a remote attacker to obtain sensitive information, caused by an error in the Sybase SQL Anywhere database component. By sending a specially-crafted request to UDP port 2638, an attacker could exploit this vulnerability to obtain sensitive information about the engine name and database port.
References: [BID-50376] [CVE-2011-2042] [XFDB-71002]

Sybase Adaptive Server Anywhere Database Engine 6.0.3.2747 and earlier as included with Symantec Ghost 6.5 allows a remote attacker to create a denial of service by sending large (> 45Kb) amounts of data to port 2638.
References: [CVE-2001-0599] [BID-2572]

Port is also IANA registered for Sybase Anywhere
 2638 tcp symantec not scanned Symantec Endpoint Protection Manager (SEPM) communicates with the embedded database on this port.

An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers might gain privileged access to the database over Port 2638/TCP.
References: [CVE-2016-8567], [BID-94549]
 2640 tcp,udp ami-control not scanned IANA registered for: Alcorn McBride Inc protocol used for device control
 2641 tcp,udp hdl-srv not scanned IANA registered for: HDL Server
 2642 tcp,udp tragic not scanned IANA registered for: Tragic
 2654 tcp,udp corel_vncadmin not scanned Corel VNC Admin
 2656 tcp,udp kana not scanned ICQ P2P, SQL Remote Connection
IANA registered for: Kana
 2657 tcp,udp sns-dispatcher not scanned SNS Dispatcher
 2658 tcp,udp sns-admin not scanned SNS Admin
 2659 tcp,udp sns-query not scanned SNS Query
 2664 tcp,udp patrol-mq-gm not scanned Patrol for MQ GM

Vulnerabilities listed: 100 (some use multiple ports)
News Glossary of Terms FAQs Polls Cool Links SpeedGuide Teams SG Premium Services SG Gear Store
Registry Tweaks Broadband Tools Downloads/Patches Broadband Hardware SG Ports Database Security Default Passwords User Stories
Broadband Routers Wireless Firewalls / VPNs Software Hardware User Reviews
Broadband Security Editorials General User Articles Quick Reference
Broadband Forums General Discussions
Advertising Awards Link to us Server Statistics Helping SG About