The Broadband Guide
SG
search advanced

Vulnerable Ports

This list (a very small part of our SG Ports database) includes TCP/UDP ports currently tested by our Security Scanner, and corresponding potential security threats. We update the list on a regular basis, however if you feel we should add other port(s) to the list or modify their descriptions, please . Any feedback and suggestions can also be posted to our Security forum.

 1 |....| 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 |....| 55 
Port(s) Protocol Service Scan level Description
 28808 tcp games not scanned MechWarrior 4 - Mercenaries
 28852 tcp applications not scanned Killing Floor
 28876 tcp trojans Premium scan Backdoor.Globe [Symantec-2005-011216-5201-99] - a proof-of-concept Trojan horse program that exploits the Microsoft Windows LoadImage API Function Integer Overflow Vulnerability (Windows XP, described in Microsoft Security Bulletin MS05-002). The Trojan is written in JavaScript and is embedded in .html files.

Trojan.Helemoo [Symantec-2005-072312-2716-99] - a backdoor trojan that exploits a MS IE DHTML Memory Corruption Vulnerability ([MS05-020]). Opens a backdoor and listens for remote commands on port 28876/tcp by default.
 28883 udp games not scanned Combat Flight Simulator 3: Battle For Europe, developer: Microsoft
 28884 udp games not scanned Combat Flight Simulator 3: Battle For Europe, developer: Microsoft
 28885 udp games not scanned Combat Flight Simulator 3: Battle For Europe, developer: Microsoft
 28886 udp games not scanned Combat Flight Simulator 3: Battle For Europe, developer: Microsoft
 28900 tcp games Members scan GameSpy Arcade - Master Server List Request, Worms 4 Mayhem
Also uses ports 3783, 6500, 6515 UDP, 6667, 13139 UDP, 27900 UDP, 28900, 29900, 29901
 28901 tcp,udp games not scanned Hoyle Games
 28902 tcp applications not scanned Unreal Tournament 2004 Master Server Browser
 28910 tcp games Members scan Heretic II server
Soldier of Fortune 2 game server
Command and Conquer
Battlefield 2142
Armies of Exigo

Nintendo Wii ports: 12400, 28910, 29900, 29901, 29920 TCP (optionally ports 80, 443, 6667 TCP, and random UDP ports)
 28960 tcp,udp games Basic scan Port used by Call of Duty, Return to Castle Wolfenstein
 29000 tcp,udp saltd-licensing not scanned PWI and PWI patches

Battlefield 2

IANA registered for: Siemens Licensing Server (TCP)
 29070 udp games Members scan Star Wars III Jedi Knight Jedi Academy (JK3)
 29104 tcp trojan Members scan NETrojan, Host Control trojans
 29118 sctp sgsap not scanned SGsAP in 3GPP [GPP Specifications] (IANA official)
 29147 tcp trojans Premium scan Backdoor.Sdbot.AI [Symantec-2005-010309-3226-99] network aware worm with backdoor capabilities. Spreads via network shares. Opens a backdoor and listens for remote commands by connecting to IRC servers on port 29147/tcp.
 29168 sctp sbcap not scanned SBcAP in 3GPP [GPP Specifications] (IANA official)
 29169 sctp iuhsctpassoc not scanned HNBAP and RUA Common Association
 29200 udp applications not scanned Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service (game interruption) via a malformed UDP packet sent to a game port, such as port 29200.
References: [CVE-2004-1524], [BID-11683]
 29292 tcp trojans Premium scan TMO Integration Service Communications port, used by Transaction Manager SaaS (HighJump Software)

BackGate Kit
Backdoor.NTHack [Symantec-2001-031517-2139-99]
 29339 tcp,udp applications not scanned Live For Speed Server
 29369 tcp trojan Premium scan ovasOn trojan
 29559 tcp trojans Premium scan Backdoor.Ducktoy [Symantec-2002-071814-5240-99] (2002.07.18) - remote access trojan, affects Windows, listens to ports 29559 and 59211 by default.

Backdoor.Latinus [Symantec-2002-060710-5206-99] - remote access trojan, afects Windows 9x/ME/NT/2k/XP, opens TCP port 11831/tcp for direct control, 29559/tcp for file transfer, may also use ports 24289/tcp, 29559/tcp.

Backdoor.AntiLam [Symantec-2002-060715-0902-99], a.k.a. AntiLamer backdoor - remote access trojan, affects Windows, listens on TCP ports 29559 and 47891, may also use port 29999.

Other trojans that use this port: DarkFace, DataRape, Pest, Vagr Nocker

Backdoor.Win32.Antilam.11 / Unauthenticated Remote Code Execution - the Win32.Antilam.11 malware aka "Backdoor.Win32.Latinus.b" (MVID-2021-0029), listens on TCP ports 11831, 29559. Third-party attackers who can reach infected systems can execute commands made available by the backdoor.
References: [MVID-2021-0324]
 29589 tcp,udp trojan not scanned KiLo trojan [Symantec-2003-021319-1815-99]
 29781 udp panorama not scanned Palo Alto Networks Panorama HA (High Availability) uses these ports:
28/tcp - HA1 control link for SSH over TCP encrypted communication
28260/tcp, 28769/tcp - used for HA1 control link for clear text communication between HA peer firewalls
28770/tcp - Panorama HA1 backup sync port
28771/tcp - heartbeat backups
29781/udp - HA2 link to synchronize sessions, table forwarding, IPSec, ARP tables
 29831 tcp,udp slapd not scanned Slapd
 29891 udp trojan not scanned The Unexplained trojan
 29900 tcp games Basic scan Nintendo Wii ports: 12400, 28910, 29900, 29901, 29920 TCP (optionally ports 80, 443, 6667 TCP, and random UDP ports)

GameSpy Arcade - GP Connection Manager. Also uses ports 3783, 6500, 6515 UDP, 6667, 13139 UDP, 27900 UDP, 28900, 29900, 29901

Battlefield 2142
Worms 4 Mayhem
Civilization iV
Command and Conquer
 29901 tcp games Members scan Nintendo Wii ports: 12400, 28910, 29900, 29901, 29920 TCP (optionally ports 80, 443, 6667 TCP, and random UDP ports)

GameSpy Arcade - GP Search Manager. Also uses ports 3783, 6500, 6515 UDP, 6667, 13139 UDP, 27900 UDP, 28900, 29900, 29901

Worms 4 Mayhem
Battlefield 2
Civilization III
 29920 tcp games Premium scan Command and Conquer Generals

Nintendo Wii ports: 12400, 28910, 29900, 29901, 29920 TCP (optionally ports 80, 443, 6667 TCP, and random UDP ports)
 29976 tcp trojan Premium scan Trojan Spirit 2001a
 29980 tcp trojan Premium scan Trojan Spirit 2001a
 29984 tcp trojan Premium scan Trojan Spirit 2001a
 29999 tcp trojans Premium scan Backdoor.AntiLam [Symantec-2002-060715-0902-99], a.k.a. AntiLamer backdoor - remote access trojan, affects Windows, listens on TCP ports 29559 and 47891, may also use port 29999.

Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoard server at port 29999 that allows for control over core robot functions like starting/stopping programs, shutdown, reset safety and more. The DashBoard server is not protected by any kind of authentication or authorization.
References: [CVE-2020-10265], [XFDB-179125]

IANA registered for: Data exchange protocol for IEC61850 in wind power plants [DEIF_AS]
 30000 tcp trojans Premium scan Pokemon Netbattle
GnomeMeeting (audio and videoconference) uses ports 30000-30010

Infector trojan (1999-04) - affects Windows 9x (ICQ). Uses ports 146, 1208, 17569, 24000, 30000

Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000.
References: [CVE-2009-4988], [BID-35933]

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.
References: [CVE-2018-1002103]

ndmps - Secure Network Data Management Protocol (IANA official)
 30000 udp applications not scanned Xlink Kai
Minetest server default port
 30001 tcp trojans Members scan Err0r32 (ErrOr32), Terr0r32 (TerrOr32) trojans

W32.Gaobot.ADX [Symantec-2004-042412-3100-99] (2004.04.24) - Windows worm that spreads through a few different methods, including open network shares, several known Windows vulnerabilities, and other backdoors like Beagle and Mydoom. Listens on these TCP ports: 63000 (HTTP), 63001 (HTTPS), 30001 (SOCKS proxy), and a FTP server on a random port.

In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained.
References: [CVE-2018-10635], [BID-104710]
 30002 udp games not scanned Colin McRae DiRT

In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained.
References: [CVE-2018-10635], [BID-104710]
 30003 tcp trojan Premium scan Lamers Death trojan

tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to port 30003.
References: [CVE-2012-0698]

In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained.
References: [CVE-2018-10635], [BID-104710]
 30004 udp amicon-fpsu-s not scanned CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows setting registers, the speed slider fraction as well as digital and analog Outputs. Additionally unautheticated reading of robot data is also possible
References: [CVE-2020-10264], [XFDB-179124]

IANA registered for: Amicon FPSU-IP VPN
 30005 tcp trojans Members scan Port sometimes associated with TR-069 - application layer protocol for remote management of end-user devices. It is a bidirectional SOAP/HTTP-based protocol that provides communication between CPE devices and auto-configuration servers (ACS). It can be used by some modems, gateways, routers, VoIP phones, set-top boxes. TR-069 has some known exploits as demonstrated at the DEFCON22 conference. Cox Communcations reportedly uses this port.

If your modem/NAT router/gateway keeps this port open and you are sure you want to filter it (potential interference with ISPs pushing firmware updates), try the following. Navigate to your router's admin interface and disable TR-069. If that does not work, look under "port forwarding", or "virtual servers", and forward port 30005 to an unused local IP address, like (192.168.1.252)

Malware using this port: Backdoor JZ, Litmus trojan

Trojan-Dropper.Win32.Delf.xk / Remote Invalid Pointer Write DOS - Win32.Delf.xk drops server.exe in AppData\Local\Temp dir and listens on TCP ports 30005,30006 and 30007. Netcat to port 30005 and input the number 9 it trys to create a file, number 2 for read file and 3 for opening a file but errors out.
References: [MVID-2021-0130]
 30006 tcp malware not scanned Trojan-Dropper.Win32.Delf.xk / Remote Invalid Pointer Write DOS - Win32.Delf.xk drops server.exe in AppData\Local\Temp dir and listens on TCP ports 30005,30006 and 30007. Netcat to port 30005 and input the number 9 it trys to create a file, number 2 for read file and 3 for opening a file but errors out.
References: [MVID-2021-0130]
 30007 tcp malware not scanned Trojan-Dropper.Win32.Delf.xk / Remote Invalid Pointer Write DOS - Win32.Delf.xk drops server.exe in AppData\Local\Temp dir and listens on TCP ports 30005,30006 and 30007. Netcat to port 30005 and input the number 9 it trys to create a file, number 2 for read file and 3 for opening a file but errors out.
References: [MVID-2021-0130]
 30010 tcp applications not scanned GnomeMeeting (audio and videoconference) uses ports 30000-30010
 30020 tcp ushare not scanned Opened by uShare, for Coherence (http://coherence.beebits.net/)
 30024 tcp applications not scanned Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."
References: [CVE-2016-9796], [BID-94649], [EDB-40862]
 30029 tcp trojan Members scan AOL Trojan (aliases: AOL Admin, Backdoor.Cheeser)
 30033 tcp teamspeak not scanned Teamspeak 3 default file transfer port.

TS3 uses the following ports:
9987 UDP (default voice port)
10011 TCP (default serverquery port)
30033 TCP (default filetransfer port)
41144 TCP (default tsdns port)

TS3 also connects to: accounting.teamspeak.com:2008 (TCP for license checks) and weblist.teamspeak.com:2010 (UDP). TS3 weblist also uses ports 2011-2110 (UDP out, first available port in range).
 30100-30103 tcp trojan Members scan NetSphere trojan uses these ports.
30100 tcp - the main port that NetSphere connects to.
30101-30103 tcp - NetSphere runs FTP services on these ports, used to transfer various files (e.g. keylog files).

NetSphere infects only Windows 9x systems. A server program called nssx.exe is placed in the C:\Windows\System directory, a "NSSX" value is added to the Run hive of the registry to launch the server.

Port 30100 is IANA registered for Remote Window Protocol (TCP/SCTP)
 30110 tcp fivem not scanned FiveM Server (modification of GTA V) uses TCP ports 30120 and 30110.
 30120 tcp fivem not scanned FiveM Server (modification of GTA V) uses TCP ports 30120 and 30110.
 30129 tcp trojans Premium scan Masters Paradise backdoor (aliases: Backdoor.Krass, Hacker's Paradise)
 30133 tcp trojans Premium scan Trojan Spirit 2001a, NetSphere Final trojan
 30260 tcp,udp kingdomsonline not scanned Kingdoms Online (CraigAvenue), Company of Heroes: Opposing Fronts (UDP)
 30301 tcp,udp applications not scanned BitTorrent
 30303 tcp,udp Ethereum Premium scan Ethereum P2P cryptocurrency uses port 30303.
Common cryptocurrency ports (TCP typically):
Bitcoin: 8333
Litecoin: 9332,9333
Dash: 9999
Dogecoin: 22556
Ethereum: 30303


Trojans that use this port:
Sockets de Troie trojan. Typically uses ports 5000, 5001, 30303, and 50505 tcp. Includes remote administration tool like Back Orifice and NetBus, so it has a server (spread with virus) and client portion.
 30331 tcp trojan Premium scan MuSka52 trojan
 30350 udp games not scanned Supreme Commander
 30351 udp games not scanned Supreme Commander
 30400 tcp gs-realtime not scanned IANA registered for: GroundStar RealTime System
 30430 tcp,udp games not scanned Frontlines: Fuel of War, developer: THQ
 30440 tcp games not scanned FIFA Soccer 2009 uses ports 30440-30449
 30449 tcp games not scanned FIFA Soccer 2009 uses ports 30440-30449
 30464 tcp exploits Members scan Port used by Slapper trojan. A number of exploit scripts bind root shells to this port. See also SMTP ETRN overflow vulnerability.
 30477 tcp games not scanned F1 2002, GTR FIA GT Racing Game
 30544 tcp applications not scanned TL-MatrikonOPC is vulnerable to a denial of service. By sending a reset command to TCP port 30544, a remote attacker could exploit this vulnerability to cause the device to crash.
References: [CVE-2013-0666], [XFDB-83861], [BID-59535]
 30564 tcp applications not scanned Multiplicity: keyboard/mouse/clipboard sharing software
 30700 tcp trojan Premium scan Mantis trojan
 30718 udp applications not scanned Lantronix Discovery for Lantronix serial-to-ethernet devices
 30720 udp applications not scanned Tremulous
 30722 tcp trojans Premium scan W32.Esbot.A [Symantec-2005-081610-2800-99] - a worm that spreads by exploiting the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (MS Security Bulletin [MS05-039]). Opens a backdoor and listens for remote commands by connecting to IRC servers on 30722/tcp (W32.Esbot.B [Symantec-2005-081716-4721-99] variant uses port 18067/tcp).
 30725 udp games not scanned Company Of Heroes
 30777 tcp applications not scanned ZangZing agent
 30814 tcp,udp applications not scanned BeamMP: Unofficial BeamNG.drive multiplayer mod. Default server port
 30888 applications not scanned Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.
References: [CVE-2012-5451]
 30947 tcp trojan Premium scan Intruse trojan
 30974 tcp trojan Premium scan Intruse trojan
 30999 tcp trojans Premium scan Backdoor.Novacal [Symantec-2005-092910-5215-99] - a backdoor server that allows unauthorized access, uses ICQ to notify the remote attacker of the compromised computer. Opens a backdoor and listens for remote commands on port 30999/tcp.

Kuang2 trojan
 31000 tcp,udp applications not scanned OpCon/xps

Titan FTP server
 31016 tcp ka-sddp not scanned Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS.
References: [CVE-2021-29644]

Kollective Agent Secure Distributed Delivery Protocol (IANA official)
 31016 udp ka-kdp not scanned IANA registered for: Kollective Agent Kollective Delivery Protocol
 31029 udp yawn not scanned YaWN - Yet Another Windows Notifier
 31038 tcp applications not scanned Diskeeper could allow a remote attacker to obtain sensitive information, caused by the improper handling of arguments by the DKService.exe service. By sending a specially-crafted RPC request to TCP port 31038, a remote attacker could exploit this vulnerability to obtain the address of loaded modules or other sensitive information.
References: [CVE-2007-4375], [XFDB-36008]
 31113 tcp worms Members scan W32.Mytob.IH@mm [Symantec-2005-072512-2831-99] mass-mailing worm that uses its own SMTP engine, opens a backdoor, and lowers security settings on the compromised computer. Opens a backdoor and listens for remote commands on port 31113/tcp. W32.Mytob.AD@mm and W32.Mytob.AA@mm variants of the worm listen to port 10087/tcp.
 31221 tcp trojan Premium scan Knark trojan
 31230 udp games not scanned Dirt Track Racing: Sprint Cars
 31240 tcp,udp games not scanned Dirt Track Racing: Sprint Cars
 31314 tcp applications not scanned Š•lectric imp node<>server communication (TLS)
 31320 tcp,udp trojan not scanned Little Witch trojan
 31332 tcp trojans Premium scan Backdoor.Grobodor [Symantec-2003-060916-4848-99] - backdoor trojan coded in Delphi, affects Windows, listens on port 31332/tcp.
 31335 udp trojan not scanned Trinoo distributed attack tool port.
 31336 tcp trojans Premium scan BOWhack, ButtFunnel trojans
 31337 tcp,udp Back Orifice Members scan This port number means "elite" in hacker/cracker spelling (3=E, 1=L, 7=T) and because of the special meaning is often used for interesting stuff... Many backdoors/trojans run on this port, the most notable being Back Orifice.

Here are some others that run on the same port: Back Fire, Baron Night, Beeone, BO client, BO Facil, BO spy, BO2, cron / crontab, Freak88, Freak2k, icmp_pipe.c, Sockdmini, ADMworm, bindshell, Elite, Gummo.

Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.
References: [CVE-2003-0719]

aMSN (aka Alvaro's Messenger) 0.96 and earlier allows remote attackers to cause a denial of service (application crash) by sending invalid data to TCP port 31337.
References: [CVE-2007-2195] [BID-23583] [OSVDB-39116]

Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
References: [CVE-2006-6563], [EDB-3333], [EDB-3330], [BID-21587]

Backdoor.Win32.Small.vjt / Unauthenticated Remote Command Execution - the malware listens on TCP port 31337. Third-party attackers who can reach the system can execute OS commands or programs further compromising the already infected machine.
References: [MVID-2021-0337]

.Net Remoting, Terraria, ncat, a netcat alternative

Eldim is a secure file upload proxy (IANA official)
 31338 tcp,udp trojans Premium scan Back Orifice, ButtFunnel, DeepBO, NetSpy DK trojans
 31339 tcp trojans Premium scan LittleWitch, Net Spy
 31340 tcp,udp trojan not scanned Little Witch trojan
 31382 tcp trojan Premium scan Lithium trojan
 31399 tcp trojan Premium scan NetSpy (DK) trojan
 31400 tcp pace-licensed not scanned PACE license server [PACE_Anti-Piracy] (IANA official)

Vulnerabilities listed: 100 (some use multiple ports)
News Glossary of Terms FAQs Polls Cool Links SpeedGuide Teams SG Premium Services SG Gear Store
Registry Tweaks Broadband Tools Downloads/Patches Broadband Hardware SG Ports Database Security Default Passwords User Stories
Broadband Routers Wireless Firewalls / VPNs Software Hardware User Reviews
Broadband Security Editorials General User Articles Quick Reference
Broadband Forums General Discussions
Advertising Awards Link to us Server Statistics Helping SG About