The Broadband Guide
SG
search advanced

Vulnerable Ports

This list (a very small part of our SG Ports database) includes TCP/UDP ports currently tested by our Security Scanner, and corresponding potential security threats. We update the list on a regular basis, however if you feel we should add other port(s) to the list or modify their descriptions, please . Any feedback and suggestions can also be posted to our Security forum.

 1 | 2 | 3 | 4 | 5 | 6 | 7 |....| 55 
Port(s) Protocol Service Scan level Description
 1527 tcp,udp tlisrv not scanned Apache Derby Network Server default port

IANA registered for: Oracle
 1612 tcp,udp appliactions not scanned Numara Asset Manager Platform (AMP) uses the following ports:
1610 - primary AMP port
1611 - communication between console and master server
Other optional ports used by AMP:
1609 - used to calculate available bandwidth for transfer windows
1612 - used by the application kiosk feature
2500 - used for multicast data transfers to agents
5400 - used for remote control only
22,23,25,135-139,445 - used for auto discovery, SSH remote inventory scans, SMB remote inventory
161 - SNMP remote inventory scan
67-69 - relays can be used to avoid opening ports over the wan

Port also used by:
NetBill Transaction Server
Video game Black and White (TCP)
 1613 tcp,udp netbill-keyrep not scanned NetBill Key Repository
 1614 tcp,udp netbill-cred not scanned NetBill Credential Server
 1615 tcp,udp netbill-auth not scanned NetBill Authorization Server
 1616 tcp,udp netbill-prod not scanned NetBill Product Server
 1661 tcp,udp netview-aix-1 not scanned netview-aix-1
 1662 tcp,udp netview-aix-2 not scanned netview-aix-2
 1663 tcp,udp netview-aix-3 not scanned netview-aix-3
 1664 tcp,udp netview-aix-4 not scanned netview-aix-4
 1665 tcp,udp netview-aix-5 not scanned netview-aix-5
 1666 tcp,udp netview-aix-6 not scanned Perforce uses port 1666 (TCP).

IANA registered for: netview-aix-6.
 1667 tcp,udp netview-aix-7 not scanned netview-aix-7
 1668 tcp,udp netview-aix-8 not scanned netview-aix-8
 1669 tcp,udp netview-aix-9 not scanned netview-aix-9
 1670 tcp,udp netview-aix-10 not scanned netview-aix-10
 1671 tcp,udp netview-aix-11 not scanned netview-aix-11
 1672 tcp,udp netview-aix-12 not scanned netview-aix-12
 1687 tcp,udp nsjtp-ctrl not scanned IANA registered for: nsjtp-ctrl
NSJTP stands for HP's Network ScanJet Transfer Protocol
 1688 tcp,udp nsjtp-data not scanned Port 1688 TCP is commonly used for Microsoft's KMS Traffic.

nsjtp-data (IANA official) - HP's Network ScanJet Transfer Protocol.
 1718 tcp applications not scanned McAfee E-Business Server could allow a remote attacker to execute arbitrary code on the system, caused by a vulnerability in the administration interface. By sending a malformed authentication packet to TCP port 1718, a remote attacker could exploit this vulnerability to cause the application to crash or execute arbitrary code with SYSTEM privileges.
References: [CVE-2008-0127], [BID-27197]

H.323 Multicast Gatekeeper Discover (IANA official)
 1719 tcp applications not scanned H.323 Unicast Gatekeeper Signaling (IANA official)
 1745 tcp,udp remote-winsock not scanned remote-winsock

The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port 1745.
References: [CVE-2003-0110]
 1949 tcp,udp ismaeasdaqlive not scanned ISMA Easdaq Live
 1950 tcp,udp ismaeasdaqtest not scanned ISMA Easdaq Test
 1988 tcp,udp tr-rsrb-p2 not scanned Backdoor.Win32.Delf.abb / Insecure Transit - the malware listens on TCP ports 1988 and 2111 but message exchange takes place on port 1988. The backdoor uses unencrypted plaintext socket communication allowing anyone who can sniff network traffic to read any communications sent or retrieved. This can disclose information to third-party well positioned attackers.
References: [MVID-2021-0206]

Cisco RSRB Priority 2 port (IANA official)
 1989 tcp,udp tr-rsrb-p3 not scanned Cisco RSRB Priority 3 port (IANA official)
 2007 udp raid-am not scanned raid-am
 2013 tcp raid-am not scanned raid-am
 20049 tcp,udp,sctp nfsrdma not scanned Network File System (NFS) over RDMA [RFC 5666] (IANA official)
 2095 tcp,udp nbx-ser not scanned PalTalk, CPanel default Web mail (TCP)

IANA registered for: NBX SER
 2096 tcp,udp nbx-dir not scanned CPanel default SSL Web mail (TCP)

IANA registered for: NBX DIR
 2160 tcp,udp apc-2160 not scanned APC 2160
 2161 tcp,udp apc-2161 not scanned APC 2161
 2171 tcp,udp msfw-storage not scanned MS Firewall Storage
 2172 tcp,udp msfw-s-storage not scanned MS Firewall SecureStorage

Backdoor.Win32.Jokerdoor / Remote Stack Buffer Overflow - the malware listens on TCP port 2172. Third party attackers who can reach an infected system can send a junk payload and trigger a classic stack buffer overflow overwriting the ECX, EIP registers and structured exception handler (SEH). When connecting you will get a "connected" server response, then we supply our payload as a parameter prefixed by "DOS" to successfully compromise the server.
References: [MVID-2021-0426]
 2173 tcp,udp msfw-replica not scanned MS Firewall Replication
 2174 tcp,udp msfw-array not scanned MS Firewall Intra Array
 2221 tcp,udp rockwell-csp1 not scanned Rockwell CSP1

ESET Anti-virus updates also use this port (TCP).

Port is IANA registered for: EtherNet/IP over TLS (TCP); EtherNet/IP over DTLS (UDP)
 2222 tcp,udp rockwell-csp2 not scanned Rockwell CSP2
ESET Remote Administrator, DirectAdmin default
Microsoft Office OS X anti-piracy network monitor

Cognex In-Signt (IANA official) uses these ports:
68 udp - DHCP In-Signt vision system only
502 tcp - Modbus
1069 tcp/udp - In-Sight
1070 tcp - machine status data
2222 udp - Ethernet IP
5753 tcp - audit message server
44818 tcp/udp - Ethernet IP
51069 tcp - In-Sight secure

Some trojans also use this port: BackDoor.Botex [Symantec-2004-062718-3311-99], SweetHeart, Rootshell, Way

The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan, allows remote or local attackers to gain privileges and execute arbitrary commands by connecting directly to TCP port 2222.
References: [CVE-2007-0655], [BID-23759]

Rockwell Automation ControlLogix is vulnerable to a denial of service, caused by the improper validation of input being sent to the buffer. By sending a specially-crafted CIP message to TCP and UDP ports 2222 and 44818, a remote attacker could exploit this vulnerability to cause the CPU to stop logic execution and enter a denial of service.
References: [XFDB-81235]

Backdoor.Win32.Mnets / Remote Stack Buffer Overflow - the backdoor listens for commands on UDP ports 2222 and 4444. Sending a mere 323 bytes we can overwrite the instruction pointer (EIP), potentially giving us program execution flow over the remote Malware.
References: [MVID-2021-0031]

Port is also IANA registered for EtherNet/IP I/O.
 2223 tcp,udp rockwell-csp3 not scanned Microsoft Office OS X antipiracy network monitor (UDP)

IANA registered for: Rockwell CSP3
 2301 tcp,udp cpq-wbem not scanned Warrior Kings, HP System Management Redirect to port 2381

Compaq Web-based Management Software is vulnerable to a buffer overflow in the authentication page "cpqlogin.htm." By default, Compaq Web-based Management Software is installed on TCP port 2301 and could allow a remote attacker to send a username containing exactly 460 bytes to overflow a buffer and execute arbitrary code on the system with administrator privileges.
References: [CVE-2001-0134] [BID-2200]

Denial of service in Compaq Management Agents and the Compaq Survey Utility via a long string sent to port 2301.
References: [CVE-1999-0772]

IANA registered for: Compaq HTTP
 2381 tcp,udp compaq-https not scanned HP Insight Manager default for Web server

IANA registered for: Compaq HTTPS
 2382 tcp,udp ms-olap3 not scanned Microsoft OLAP
 2383 tcp,udp ms-olap4 not scanned Microsoft OLAP
 65112 tcp,udp tv-multicast not scanned Port used by One-to-One TV over IP Multicast. Used for IP-based multimedia "chunk streaming", extending the capability of multimedia streaming to provide every client with individual content over the Internet.
 65100 tcp,udp applications not scanned Port used by the Sage Act! customer and contact manager. Port 65100 serves Act! as a link that offers remote access to information in the enterprise network. Act! can also be integrated into business programs such as accounting tools and MS Office.
 65001 tcp,udp hdhomerun not scanned HDHomeRun DVR from SiliconDust uses this port. HDHomeRun can be administered over the Ethernet link to tune channels, broadcast an MPEG stream, etc. The device can be viewed/controlled through a range of Linux/Windows DVR/PVR programs.

List of all used ports:
Discovery Protocol - UDP 65001
Control Protocol - TCP 65001
Video stream - UDP 5002 and UDP 5004
LIRC for IR on HD Homerun - UDP 5000
 5002 udp hdhomerun not scanned Drobo Dashboard's discovery uses port 5002 UDP. It broadcasts periodically looking for Drobo NAS devices to manage.

HDHomeRun DVR from SiliconDust uses this port. HDHomeRun can be administered over the Ethernet link to tune channels, broadcast an MPEG stream, etc. The device can be viewed/controlled through a range of Linux/Windows DVR/PVR programs. List of all used ports:
Discovery Protocol - UDP 65001
Control Protocol - TCP 65001
Video stream - UDP 5002 and UDP 5004
LIRC for IR on HD Homerun - UDP 5000

Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.
References: [CVE-2004-0352], [BID-9806]
 5004 udp hdhomerun not scanned Port used by Real Time Streaming Protocol (RTSP) for Microsoft Windows Media streaming services.

RTSP uses the following ports:
554 TCP - used for accepting incoming RTSP client connections and for delivering data packets to clients that are streaming by using RTSPT.
5004 UDP - used for delivering data packets to clients that are streaming by using RTSPU.
5005 UDP - used for receiving packet loss information from clients and providing synchronization information to clients that are streaming by using RTSPU.
See also: port 1755 - Microsoft Media Server (MMS) protocol

HDHomeRun DVR from SiliconDust uses port 5004 UDP. HDHomeRun can be administered over the Ethernet link to tune channels, broadcast an MPEG stream, etc. The device can be viewed/controlled through a range of Linux/Windows DVR/PVR programs.
List of all HDHomeRun used ports:
Discovery Protocol - UDP 65001
Control Protocol - TCP 65001
Video stream - UDP 5002 and UDP 5004
LIRC for IR on HD Homerun - UDP 5000

Cisco Spark application (Cisco Webex Teams services) uses these ports:
443, 8443 TCP - signaling
5004 TCP/UDP - media
33434 TCP/UDP - media port
Note: older versions of Cisco Webex Teams services may use these additional ports: 53, 123, 444 TCP and 33434-33598 UDP (SIP calls)

ShoreTel IP Telephony system uses the following ports
2427 UDP - IP phones listening port
2727 UDP - switches listening port
5004 UDP - voice packets
5440 TCP - HTTP CSIS, 5440 UDP - Location Service Protocol
5441 UDP - ShoreSIP
5442, 5446 UDP - DRS
5443, 5444, 5445 UDP - Bandwidth Reservation Protocol
5447, 5449, 5469 TCP - CAS & web proxy
5555 TCP - Shoreline diagnostic port (ipbxctl –diag)
 64320 tcp,udp activepdf not scanned Port used by ActivePDF software - automates PDF generation process from different sources, such as a website

ActivePDF WebGrabber - port 64320
ActivePDF Server - port 53535
ActivePDF DocConverter - port 53540 and port 53541
 53535,53540,53541 tcp,udp activepdf not scanned ESET Live Grid, Antispam and Web Control

ActivePDF software - automates PDF generation process from different sources, such as a website
ActivePDF WebGrabber - port 64320
ActivePDF Server - port 53535
ActivePDF DocConverter - port 53540 and port 53541
 64087 udp games not scanned Crysis game uses this port.

The ports for Crysis are as follows:
TCP 29900, 29901, 28910, 6667
UDP 64087

When hosting a server the following ports are used:
TCP 29900, 29901, 28910, 443, 80
UDP 64087, 29910, 27900, 27901
 62516 udp ireike not scanned IREIKE, SonicWall VPN, NetScreen Remote Client

Port 62516 is used for communications between the IKE service and driver for interface detection. The IKE service sends a broadcast, and it should be blocked by the driver. But if DNE (Deterministic NDIS) is not bound to an interface, this broadcast will be sent out.
 62514 udp vpn not scanned Cisco VPN Service to Cisco Systems IPSec Driver

Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary code via a long request to UDP port 62514.
References: [CVE-2009-1943], [BID-35154]
 62515 udp vpn not scanned Cisco VPN Client - also employs Network Admission Control (NAC)
 62078 tcp,udp upnp not scanned UPnP (Universal Plug and Play), iTunes

Port used by UPnP for multimedia files sharing, also used for synchronizing iTunes files between devices.
 61695 tcp,udp surfcontrol not scanned SurfControl Web Filter - uses port 61695 to establish communication with Juniper Networks Security Devices
 9020 udp surfcontrol not scanned Juniper Networks SurfControl URL Filtering

Sony PlayStation could allow a local attacker to execute arbitrary code on the system, caused by an error in the kernel loader. By sending a specially crafted payload to port 9020, an attacker could exploit this vulnerability to execute arbitrary code on the system.
References: [XFDB-136997]
 61616 tcp,udp activemq not scanned Apache ActiveMQ, Java Message Service (JMS)

Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets to port (1) 61615 or (2) 61616, aka Bug ID CSCtz90114.
References: [CVE-2013-3389]
 60001 udp nat-traverse not scanned nat-traverse, Vorsis
The nat-traverse application utilizes UDP port 60001 to pass through NAT gateways to generate links between nodes located behind these gateways.
Vorsis audio processors employ UDP and TCP port 60001 to communicate with their host.
 60000 udp sco not scanned SCO Copy Protection Demon (CPD)
Among the products protected by SCO CPD are the SCO UnixWare, SCO OpenServer, Smallfoot, SCOoffice Server, WebFace, SCOx Web Services Substrate, Me Inc., and Caldera WebSpyder.

Backdoor.Win32.MiniBlackLash / Remote DoS - MiniBlackLash listens on both TCP port 6711 and UDP port 60000. Sending a large HTTP request string of junk chars to UDP port 60000 will crash this backdoor.
References: [MVID-2021-0060]
 59000 tcp,udp applications not scanned Tekkotsu, Cisco Agent Desktop
Tekkotsu is an open-source environment for the programming of robots.
Cisco Agent Desktop is an application for Computer Telephony Integration (CTI).
 57588 tcp,udp gtk not scanned Gtk#
The Gtk# GUI toolkit from Novell employs port 57588 to connect with its host site. It contains a collection of .NET bindings and an assortment of GNOME libraries.
 54345 tcp loadrunner not scanned Port used by HP LoadRunner for checking performance and behavior of a system when under load.

Stack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent, Performance Center Agent, and Monitor over Firewall allows remote attackers to execute arbitrary code via a packet with a long server_ip_name field to TCP port 54345, which triggers the overflow in mchan.dll.
References: [CVE-2007-0446], [BID-22487]
 52028 tcp,udp applications not scanned Altiris Agent for Linux, Mac and Unix
BibleTime for Linux
 52001 tcp,udp applications not scanned Xlockmore, which is the maintained edition of Xlock, makes use of port 52001 to administer an X server network. Xlock prevents illegal access to the X server while the user is still keying in his or her password.

Jabber Session Manager (JSM) also employs port 52001 for administering instant messaging activities.
 50001 tcp,udp applications not scanned Discord uses ports 50001-50004 for media streaming

Serv-U uses ports 50000-50004

Java Remote Shell Server, Zotero, IBM DB2

M*Modal Fluency Direct (3M medical dictation software)

The management interface on the 2wire Gateway 1700HG, 1701HG, 1800HW, 2071, 2700HG, and 2701HG-T with software before 5.29.52 allows remote attackers to cause a denial of service (reboot) via a %0d%0a sequence in the page parameter to the xslt program on TCP port 50001.
References: [CVE-2009-3962]
 49165 tcp,udp applications not scanned Siebel Server - Siebel Customer Relationship Management application
 49160 tcp,udp applications not scanned SJPhone (VoIP softphone), Azureus/Vuze BitTorrent client
 49153 tcp applications not scanned ANTLR, ANother Tool for Language Recognition, (formerly PCCTS) - a parser generator for recognizing languages
 27017 udp steam not scanned Port used by Valve Steam Friends, an instant messaging protocol that is built into Steam, Counter-Strike, Xpire, MBL TF2 Tango.

IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017.
References: [CVE-2015-1937]
 27020 tcp,udp steam not scanned Valve Steam Client

Team Fortress 2, Day of Defeat, Counter Strike uses ports 27020-27039 (TCP/UDP).
 5005 udp ms-rtsp not scanned Port used by Real Time Streaming Protocol (RTSP) for Microsoft Windows Media streaming services.

RTSP uses the following ports:
554 TCP - used for accepting incoming RTSP client connections and for delivering data packets to clients that are streaming by using RTSPT.
5004 UDP - used for delivering data packets to clients that are streaming by using RTSPU.
5005 UDP - used for receiving packet loss information from clients and providing synchronization information to clients that are streaming by using RTSPU.
See also: port 1755 - Microsoft Media Server (MMS) protocol
 48002 tcp,udp nimhub not scanned Nimbus Hub
 47624 tcp,udp applications not scanned Battlecom, Age of Empires II, MechCommander 2, Star Wars Galactic Battlegrounds, Flight Simulator 2002 (TCP), Total Annihilation (TCP), Stronghold Crusader (TCP), Cossacks (TCP).
Spiral Knights uses ports 47624-47634.
IANA registered for Direct Play Server.
 2400 tcp,udp applications not scanned Battlecom, Homeworld 2

Portd trojan also uses this port (TCP).

Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.
References: [CVE-2011-0742], [BID-46024]

Heap-based buffer overflow in ZfHIPCND.exe in Novell Zenworks 7 Handheld Management (ZHM) allows remote attackers to execute arbitrary code via a crafted request to TCP port 2400.
References: [CVE-2010-4299] [SECUNIA-42130]

Port also IANA registered for OpEquus Server
 2300 tcp,udp applications not scanned Combat Flight Simulator 3: Battle For Europe (UDP), Battlecom, Age of Empires III (ports 2300-2310), eJamming Station, Heroes of Might and Magic III (TCP), Realflight G3 (UDP)

Aliens vs Predator uses ports 2300-2400 (UDP)

Storm, Xplorer trojans also use port 2300 (TCP).
 48000 tcp,udp nimcontroller not scanned World in Conflict (WIC) 1.008 and earlier allows remote attackers to cause a denial of service (access violation and crash) via a zero-byte data block to TCP port 48000, which triggers a NULL pointer dereference.
References: [CVE-2008-6713], [BID-29888]

Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon crash) via a large packet to TCP or UDP port 48000.
References: [CVE-2007-5711] [OSVDB-39019] [SECUNIA-27417]

Port is also IANA registered for Nimbus Controller.
 48003 tcp,udp nimgtw not scanned Nimbus Gateway
 45682 tcp,udp applications not scanned pseudo-default uTorrent port
 45100 tcp,udp applications not scanned Limewire client magnet, Azureus
 42511 tcp inoculateit not scanned eTrust AV - default port for Computer Associates' eTrust antivirus, a.k.a InoculateIT.
 42510 tcp,udp caerpc not scanned Computer Associates eTrust RPC
 42508 tcp,udp candp not scanned Computer Associates network discovery protocol
 42509 tcp,udp candrp not scanned Computer Associates discovery response
 42424 tcp applications not scanned ASP.NET Session State, ASP.NET State Service
 41952 tcp,udp applications not scanned Tversity Media Player - this application uses port 41952 to download video, audio and/or music files from the Internet. You can run TVersity in PCs, as well as in Playstations, Nintendo Wii, and the Xbox 360.

BitTorrent also uses this port.
 40116 tcp,udp applications not scanned GMPlayer - application uses port 40116 for downloading/upstreaming music, audio and/or video files from the Internet.
 38121 tcp,udp applications not scanned Squid - a caching proxy server for the Web supporting HTTP, HTTPS, FTP, Telnet and SSL. It reduces bandwidth and improves response times by caching repeated requests. Squid is free software, intended to run on Unix-like systems but it also runs on Windows-based systems.

Cabal Server Online also uses this port.
 38080 tcp,udp applications not scanned hpcmips, JBoss Application Server
 37892 tcp,udp applications not scanned devel/haddock 0.2
 36987 tcp,udp robocode not scanned Robocode - an educational game, intended to help gamers learn Java programming.
 35332 tcp,udp bribble not scanned Bribble Chat
 34572 tcp applications not scanned ServeRAID Manager
IBM Director 5.10
 34571 tcp serveraid not scanned ServeRAID Manager

Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via a "bubba" local user account, an open TCP port 34571, or when a local DHCP server is unavailable, a DHCP server on the manufacturer's test network.
References: [CVE-2003-0983]
 34570 udp adaptec not scanned Adaptec Storage Manager
 32769 tcp,udp first-os-ports not scanned FileNet RPC (TCP)

first ports typically used for outgoing connections by some Linux distros like Red Hat: see /etc/rc.d/init.d/network and /proc/sys/net/ipv4/ip_local_port_range
 32770 tcp,udp first-os-ports not scanned first ports typically used for outgoing connections by some Linux distros like Red Hat: see /etc/rc.d/init.d/network and /proc/sys/net/ipv4/ip_local_port_range
 31000 tcp,udp applications not scanned OpCon/xps

Titan FTP server

Vulnerabilities listed: 100 (some use multiple ports)
News Glossary of Terms FAQs Polls Cool Links SpeedGuide Teams SG Premium Services SG Gear Store
Registry Tweaks Broadband Tools Downloads/Patches Broadband Hardware SG Ports Database Security Default Passwords User Stories
Broadband Routers Wireless Firewalls / VPNs Software Hardware User Reviews
Broadband Security Editorials General User Articles Quick Reference
Broadband Forums General Discussions
Advertising Awards Link to us Server Statistics Helping SG About