
Shortcuts
|
Vulnerable Ports
This list (a very small part of our SG Ports database) includes TCP/UDP ports currently tested by our Security Scanner, and corresponding potential security threats.
We update the list on a regular basis, however if you feel we should add other port(s) to the list or modify their descriptions, please .
Any feedback and suggestions can also be posted to our Security forum.
Port(s) |
Protocol |
Service |
Scan level |
Description |
2369 |
tcp,udp |
bif-p2p |
not scanned |
Blockchain Identifier InFrastructure P2P |
2371 |
tcp |
hp-rda |
not scanned |
HP Remote Device Access (IANA official) |
2372 |
tcp,udp |
lanmessenger |
not scanned |
Buffer overflow in k9filter.exe in BlueCoat K9 Web Protection 3.2.36, and probably other versions before 3.2.44, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 2372.
References: [CVE-2007-1685] [OSVDB-37186] [BID-24373] [SECUNIA-25593]
LanMessenger (IANA official) |
2375 |
tcp |
docker |
not scanned |
A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface).
References: [CVE-2016-9223], [BID-95024], [EDB-42650]
Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container and use chroot to escape the container-jail.
References: [EDB-42356]
Docker REST API (IANA official) |
2376 |
tcp |
docker-s |
not scanned |
Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a Docker container with the '/' path mounted with read/write permissions on the host server that is running the Docker container. As the Docker container executes command as uid 0 it is honored by the host operating system allowing the attacker to edit/create files owned by root. This exploit abuses this to creates a cron job in the '/etc/cron.d/' path of the host server.
References: [EDB-42650]
Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container and use chroot to escape the container-jail.
References: [EDB-42356]
Docker REST API (ssl) (IANA official) |
2377 |
tcp |
swarm |
not scanned |
Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Docker information.
References: [CVE-2024-4159]
RPC interface for Docker Swarm (IANA official) |
2378 |
udp |
dali |
not scanned |
IANA registered for: DALI lighting control |
2379 |
tcp |
etcd-client |
not scanned |
KGS Go Server
IANA registered for: etcd client communication |
2380 |
tcp,udp |
applications |
not scanned |
Buffer overflow in the administration web server for GoodTech Telnet Server 4.0 and 5.0, and possibly all versions before 5.0.7, allows remote attackers to execute arbitrary code via a long string to port 2380.
References: [CVE-2005-0768]
IANA registered for: etcd server to server communication (TCP) |
2381 |
tcp,udp |
compaq-https |
not scanned |
HP Insight Manager default for Web server
IANA registered for: Compaq HTTPS
|
2382 |
tcp,udp |
ms-olap3 |
not scanned |
Microsoft OLAP |
2383 |
tcp,udp |
ms-olap4 |
not scanned |
Microsoft OLAP |
2399 |
tcp,udp |
fmpro-fdal |
not scanned |
IANA registered for: FileMaker, Inc. - Data Access Layer |
2400 |
tcp,udp |
applications |
not scanned |
Battlecom, Homeworld 2
Portd trojan also uses this port (TCP).
Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.
References: [CVE-2011-0742], [BID-46024]
Heap-based buffer overflow in ZfHIPCND.exe in Novell Zenworks 7 Handheld Management (ZHM) allows remote attackers to execute arbitrary code via a crafted request to TCP port 2400.
References: [CVE-2010-4299] [SECUNIA-42130]
Port also IANA registered for OpEquus Server |
2401 |
tcp,udp |
cvspserver |
not scanned |
IANA registered for: cvspserver |
2402 |
tcp,udp |
taskmaster2000 |
not scanned |
TaskMaster 2000 Server |
2403 |
tcp,udp |
taskmaster2000 |
not scanned |
TaskMaster 2000 Web |
2404 |
tcp |
applications |
not scanned |
An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 1703, and SICAM AK 3. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode. A cold start might be required to recover the system, a Denial-of-Service Vulnerability.
References: [CVE-2016-7987], [BID-93832]
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on port 2404/TCP.
References: [CVE-2019-6831]
IANA registered for: IEC 60870-5-104 process control over IP (TCP/UDP) |
2407 |
tcp |
trojan |
Premium scan |
yoyo trojan
Navision Financials Server 2.60 and earlier allows remote attackers to cause a denial of service by sending a null character and a long string to the server port (2407), which causes the server to crash.
References: [BID-2539], [CVE-2001-0392], [XFDB-6318]
Port is also IANA registered for Orion |
2408 |
tcp |
railgun-webaccl |
not scanned |
CloudFlare Railgun Web Acceleration Protocol [CloudFlare] (IANA official) |
2414 |
tcp |
trojans |
Premium scan |
VBS.Shania [Symantec-2004-020217-3141-99] (2004.02.02) - remote access trojan. Affects all current Windows versions, listens on port 2414. |
2418 |
tcp |
trojan |
Premium scan |
Backdoor.Intruzzo [Symantec-2002-051012-5520-99] |
2420 |
tcp,udp |
dslremote-mgmt |
not scanned |
Westell Remote Access (UDP)
IANA registered for: DSL Remote Management |
2422 |
udp |
games |
not scanned |
Scrabble Complete |
2424 |
udp |
games |
not scanned |
Scrabble Complete
KOFAX-SVR (TCP/UDP) [Steven_Kilby] (IANA official) |
2424 |
tcp |
applications |
not scanned |
OrientDB database listening for Binary client connections |
2425 |
tcp,udp |
fjitsuappmgr |
not scanned |
Telnet, IP Messenger for Windows
IANA registered for: Fujitsu App Manager |
2426 |
udp |
games |
not scanned |
Scrabble Complete |
2427 |
tcp,udp |
mgcp-gateway |
not scanned |
ShoreTel IP Telephony system uses the following ports:
2427 UDP - IP phones listening port
2727 UDP - switches listening port
5004 UDP - voice packets
5440 TCP - HTTP CSIS, 5440 UDP - Location Service Protocol
5441 UDP - ShoreSIP
5442, 5446 UDP - DRS
5443, 5444, 5445 UDP - Bandwidth Reservation Protocol
5447, 5449, 5469 TCP - CAS & web proxy
5555 TCP - Shoreline diagnostic port (ipbxctl –diag)
Media Gateway Control Protocol Gateway (IANA official) |
2432 |
tcp,udp |
codasrv |
not scanned |
codasrv |
2433 |
tcp,udp |
codasrv-se |
not scanned |
codasrv-se |
2442 |
tcp |
trojans |
Premium scan |
W32.Spybot.NYT [Symantec-2005-041715-4455-99] (2005.04.17) - worm with DDoS (distributed denial of service) and backdoor capabilities. Spreads through network shares, exploits multiple vulnerabilities, and opens a backdoor via IRC channels on port 2442/tcp.
|
2444 |
tcp |
trojans |
Premium scan |
Backdoor.Delf [Symantec-2003-050207-0707-99] - remote access and keylogging trojan family of backdoors, affect Windows. Different varians listen to these TCP ports: 23, 2189,2444,27378.
Cisco Unified Communications Manager deployed in secure mode is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by CTLProvider.exe. By sending an overly long request to TCP port 2444, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the service to crash.
References: [CVE-2008-0027], [BID-27313] |
2447 |
tcp,udp |
ovwdb |
not scanned |
IANA registered for: OpenView NNM daemon |
2455 |
tcp,udp |
wago-io-system |
not scanned |
Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools. Specially crafted packets may also be sent to Port 2455/TCP/IP, used in Codesys management software, which may result in a denial-of-service condition of communications with commissioning and service tools.
References: [CVE-2018-8836], [BID-103726]
An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.
References: [CVE-2018-5459], [XFDB-139037]
IANA registered for: WAGO-IO-SYSTEM |
2459 |
tcp,udp |
xrpl |
not scanned |
IANA registered for: Community |
2463 |
tcp,udp |
lsi-raid-mgmt |
not scanned |
IANA registered for: LSI RAID Management |
2465 |
tcp,udp |
lbm |
not scanned |
Load Balance Management |
2466 |
tcp,udp |
lbf |
not scanned |
Load Balance Forwarding |
2479 |
tcp |
ssm-els |
Premium scan |
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
References: [CVE-2012-2217]
SecurSight Event Logging Server (SSL) (TCP/UDP) (IANA official) |
2480 |
tcp,udp |
powerexchange |
not scanned |
OrientDB database listening for HTTP client connections (TCP)
IANA registered for: Informatica PowerExchange Listener |
2481 |
tcp,udp |
giop |
not scanned |
Oracle GIOP |
2482 |
tcp,udp |
giop-ssl |
not scanned |
Oracle GIOP SSL |
2483 |
tcp,udp |
ttc |
not scanned |
Oracle database listening for unsecure client connections to the listener, replaces port 1521
IANA registered for: Oracle TTC |
2484 |
tcp,udp |
ttc-ssl |
not scanned |
Oracle database listening for SSL client connections to the listener
IANA registered for: Oracle TTC SSL |
2485 |
tcp |
netobjects1 |
Premium scan |
Backdoor.Djump [Symantec-2003-090116-0418-99] (2003.09.01) - a trojan horse that opens TCP ports 21009 and 2485 on a computer
Port is also IANA registered for Net Objects1 |
2486 |
tcp,udp |
netobjects2 |
not scanned |
Net Objects2 |
2492 |
tcp,udp |
groove |
not scanned |
GROOVE |
2499 |
tcp,udp |
unicontrol |
not scanned |
gBox, CWShare
IANA registered for: UniControl |
2500 |
tcp,udp |
rtsserv |
Premium scan |
Numara Asset Manager Platform (AMP) uses the following ports:
1610 - primary AMP port
1611 - communication between console and master server
Other optional ports used by AMP:
1609 - used to calculate available bandwidth for transfer windows
1612 - used by the application kiosk feature
2500 - used for multicast data transfers to agents
5400 - used for remote control only
22,23,25,135-139,445 - used for auto discovery, SSH remote inventory scans, SMB remote inventory
161 - SNMP remote inventory scan
67-69 - relays can be used to avoid opening ports over the wan
IPContact
TheosMessenger, TheosNet-Admin uses these ports:
2500/tcp, 2501/tcp - listening for client connections
43047/tcp, 43048/tcp - service ports
Macromedia Sitespring 1.2.0 (277.1) using Sybase runtime engine 7.0.2.1480 allows remote attackers to cause a denial of service (crash) via a long malformed request to TCP port 2500, possibly triggering a buffer overflow.
References: [BID-5132], [CVE-2002-1026], [XFDB-9458]
IANA registered for: Resource Tracking system server |
2501 |
tcp,udp |
rtsclient |
not scanned |
TheosMessenger, TheosNet-Admin uses these ports:
2500/tcp, 2501/tcp - listening for client connections
43047/tcp, 43048/tcp - service ports
IANA registered for: Resource Tracking system client |
2506 |
tcp |
applications |
not scanned |
Jana Server is vulnerable to a denial of service attack. A remote attacker could send specially-crafted data to the http-server module listening on TCP port 2506 and the pna-proxy module listening on TCP port 1090 to cause the server to enter into an infinite loop.
References: [BID-11780], [XFDB-18308]
Port is also IANA registered for jbroker (TCP/UDP) |
2509 |
tcp |
games |
not scanned |
The Political Machine |
2512 |
tcp,udp |
citrixima |
not scanned |
Citrix IMA uses port 2512 TCP (IANA registered).
Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server), Access Essentials and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.
References: [CVE-2008-0356], [BID-27329] |
2513 |
tcp,udp |
citrixadmin |
not scanned |
Citrix Management Console uses port 2513 TCP. FMA based platforms 7.5 and later do not use the port.
Port is IANA registered for Citrix ADMIN
Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server), Access Essentials and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513.
References: [CVE-2008-0356], [BID-27329] |
2517 |
tcp,udp |
call-sig-trans |
not scanned |
H.323 Annex E Call Control Signalling Transport (IANA official) |
2518 |
tcp,udp |
willy |
not scanned |
IANA registered for: Willy |
2525 |
tcp |
altsmtp |
Members scan |
Sometimes used as an alternate to port 25 SMTP (Simple Mail Transfer Protocol). This is useful as a dedicated port for VPN clients or for those who cannot directly send mail to a mail server outside of their ISP's network because of ISPs blocking port 25.
Backdoor.Rockse [Symantec-2003-050614-4623-99] (2005.05.06) - remote access trojan. Affects Windows, opens a server on port 2020 or 2525.
Backdoor.Berbew.R [Symantec-2005-051915-2101-99] (2005.05.19) - remote access trojan that steals passwords and opens backdoors on ports 2525/tcp and 4495/tcp. |
2532 |
tcp |
applications |
not scanned |
HP OpenView Network Node Manager (OV NNM) is vulnerable to a denial of service, caused by an error in the ovtopmd service. By sending an exit request (0x36) packet to TCP port 2532, a remote attacker could cause the ovtopmd service to terminate.
References: [CVE-2008-1853], [BID-28745] |
2535 |
tcp |
trojans |
Members scan |
W32.Beagle.W@mm [Symantec-2004-042617-0238-99] and W32.Beagle.X@mm [Symantec-2004-042815-2313-99] variants - mass mailing worm and backdoor trojan. Affects all current Windows versions, opens a backdoor (it listens on TCP port 2535) and attempts to spread through file-sharing networks.
Port 2556 was used by earlier variants of the worm, like W32.Beagle.M@mm [Symantec-2004-031310-3624-99] and W32.Beagle.N@mm [Symantec-2004-031508-5302-99].
Port is IANA assigned for MADCAP - Multicast Address Dynamic Client Allocation Protocol |
2536 |
tcp |
trojans |
Premium scan |
W32/Colevo@MM [Symantec-2003-062813-0620-99] (2003.06.28) - mass mailing worm which harvests MSN Messenger contact addresses with backdoor capability. It opens ports 1168-1170 and 2536.
Schneider Electric Accutech Manager is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to port 2536 of the RFManagerService, which could allow the attacker to view, add, modify or delete information in the back-end database.
References: [XFDB-90180]
Port is also IANA registered for:
2536/tcp - btpp2audctr1 |
2537 |
tcp |
upgrade |
not scanned |
A vulnerability has been reported in Schneider Electric Accutech Manager, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within RFManagerService.exe when processing HTTP requests and can be exploited to cause a heap-based buffer overflow by sending a specially crafted GET request with more than 260 bytes to TCP port 2537.
References: [CVE-2013-0658], [SECUNIA-52034]
Upgrade Protocol (IANA official) |
2543 |
tcp,udp |
applications |
not scanned |
SIP |
2546 |
tcp,udp |
vytalvaultbrtp |
not scanned |
vytalvaultbrtp |
2547 |
tcp,udp |
vytalvaultvsmp |
not scanned |
vytalvaultvsmp |
2548 |
tcp,udp |
vytalvaultpipe |
not scanned |
vytalvaultpipe |
2555 |
tcp |
trojans |
Members scan |
Compaq WCP
Lion trojan, T0rn Rootkit |
2556 |
tcp |
trojans |
Members scan |
W32.Beagle.M@mm [Symantec-2004-031310-3624-99] - mass mailing worm and backdoor trojan, 03.13.2004. Affects all current Windows versions, opens a backdoor (it listens on TCP port 2556) and attempts to spread through file-sharing networks.
Port also used by other variants of the worm, like W32.Beagle.N@mm [Symantec-2004-031508-5302-99]. |
2565 |
tcp |
trojan |
Premium scan |
Striker trojan |
2581 |
tcp,udp |
argis-te |
not scanned |
ARGIS TE |
2582 |
tcp,udp |
argis-ds |
not scanned |
ARGIS DS |
2583 |
tcp |
trojan |
Premium scan |
WinCrash 2 trojan |
2589 |
tcp |
trojan |
Premium scan |
Dagger |
2592 |
tcp,udp |
netrek |
not scanned |
Netrek network game |
2593 |
tcp,udp |
mns-mail |
not scanned |
RunUO—Ultima Online server
IANA registered for: MNS Mail Notice Service |
2595 |
tcp,udp |
worldfusion1 |
not scanned |
World Fusion 1 |
2596 |
tcp,udp |
worldfusion2 |
not scanned |
World Fusion 2 |
2598 |
tcp,udp |
citriximaclient |
not scanned |
Citrix NetScaler gateway XenDesktop/XenApp VDA uses port 2598 TCP/UDP for access to applications and virtual desktops by ICA/HDX with Session Reliability.
new ICA - when Session Reliability is enabled, TCP port 2598 replaces port 1494
IANA registered for: Citrix MA Client |
2599 |
tcp,udp |
snapd |
not scanned |
SonicWALL anti-spam traffic between Remote Analyzer (RA) and Control Center (CC)
IANA registered for: Snap Discovery |
2600 |
tcp |
trojan |
Premium scan |
Digital RootBeer |
2601 |
tcp,udp |
discp-client |
not scanned |
zebra vty
IANA registered for: discp client
McAfee Network Threat Behavior Analysis could allow a remote attacker from within the local network to gain elevated privileges on the system, caused by an error related to the default configuration in the Zebra service. By connecting to port 2601 with telnet, an attacker could exploit this vulnerability to gain unrestricted root access to the machine.
References: [XFDB-85937] [BID-61420] |
2602 |
tcp,udp |
discp-server |
not scanned |
RIPd vty
IANA registered for: discp server |
2606 |
tcp |
applications |
not scanned |
Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to upload arbitrary files, and execute arbitrary code, via directory traversal sequences in requests to TCP port 2606.
References: [CVE-2008-3685]
Heap-based buffer overflow in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to execute arbitrary code via crafted packet data to TCP port 2606.
References: [CVE-2008-3684] [SECUNIA-37070]
Dell Netmon (IANA official) |
2608 |
tcp |
wag-service |
not scanned |
Backdoor.Win32.Mazben.es / Unauthenticated Open Proxy - the malware listens on random TCP ports, known 2608, 6751, 3087, 5947. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
References: [MVID-2021-0377]
Wag Service (IANA official) |
2610 |
tcp,udp |
versa-tek |
not scanned |
TrackiT mobile device monitoring (TCP)
IANA registered for: VersaTek |
2611 |
tcp |
games |
not scanned |
Black and White |
2612 |
tcp,udp |
qpasa-agent |
not scanned |
Games: Black and White (TCP)
IANA registered for: Qpasa Agent |
2621 |
tcp,udp |
miles-apart |
not scanned |
Oracle Procedural Gateway
IANA registered for: Miles Apart Jukebox Server |
2627 |
tcp |
trojans |
Members scan |
Backdoor.Rallovs.B [Symantec-2012-011108-4024-99] (2012.01.10) - a trojan horse that opens a backdoor on TCP port 2627 on the compromised computer.
Port is also IANA registered for Moshe Beeri. |
2636 |
tcp,udp |
solve |
not scanned |
IANA registered for: Solve |
2638 |
udp |
applications |
not scanned |
CiscoWorks Common Services could allow a remote attacker to obtain sensitive information, caused by an error in the Sybase SQL Anywhere database component. By sending a specially-crafted request to UDP port 2638, an attacker could exploit this vulnerability to obtain sensitive information about the engine name and database port.
References: [BID-50376] [CVE-2011-2042] [XFDB-71002]
Sybase Adaptive Server Anywhere Database Engine 6.0.3.2747 and earlier as included with Symantec Ghost 6.5 allows a remote attacker to create a denial of service by sending large (> 45Kb) amounts of data to port 2638.
References: [CVE-2001-0599] [BID-2572]
Port is also IANA registered for Sybase Anywhere |
2638 |
tcp |
symantec |
not scanned |
Symantec Endpoint Protection Manager (SEPM) communicates with the embedded database on this port.
An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers might gain privileged access to the database over Port 2638/TCP.
References: [CVE-2016-8567], [BID-94549] |
2640 |
tcp,udp |
ami-control |
not scanned |
IANA registered for: Alcorn McBride Inc protocol used for device control |
2641 |
tcp,udp |
hdl-srv |
not scanned |
IANA registered for: HDL Server |
2642 |
tcp,udp |
tragic |
not scanned |
IANA registered for: Tragic |
2654 |
tcp,udp |
corel_vncadmin |
not scanned |
Corel VNC Admin |
2656 |
tcp,udp |
kana |
not scanned |
ICQ P2P, SQL Remote Connection
IANA registered for: Kana |
2657 |
tcp,udp |
sns-dispatcher |
not scanned |
SNS Dispatcher |
2658 |
tcp,udp |
sns-admin |
not scanned |
SNS Admin |
2659 |
tcp,udp |
sns-query |
not scanned |
SNS Query |
Vulnerabilities listed: 100 (some use multiple ports)
|