Shortcuts

Vulnerable Ports

This list (a very small part of our SG Ports database) includes TCP/UDP ports currently tested by our Security Scanner, and corresponding potential security threats. We update the list on a regular basis, however if you feel we should add other port(s) to the list or modify their descriptions, please . Any feedback and suggestions can also be posted to our Security forum.

1 |....| 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55

Port(s)	Protocol	Service	Scan level	Description
33982	tcp,udp	applications	not scanned	Dezta software
34000	udp	games	not scanned	Cossacks uses ports 34000-34005 (UDP) Heroes of Annihilated Empires also uses ports 34000-34005 (TCP/UDP)
34005	udp	games	not scanned	Cossacks uses ports 34000-34005 (UDP) Heroes of Annihilated Empires also uses ports 34000-34005 (TCP/UDP)
34012	tcp,udp	applications	not scanned	Access Remote PC
34100	tcp,udp		not scanned	The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid, pwd, or usr key in a GET request on port 34100. References: [CVE-2018-12640] The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100. References: [CVE-2018-11560]
34197	udp	games	not scanned	Factorio, a multiplayer survival and factory-building game
34210	tcp	games	not scanned	TCP 34210 is used by DragonBall Z Legends game (Android)
34251	udp	worm	not scanned	W32.HLLW.Manex [Symantec-2002-111111-2931-99] - a worm coded in Delphi and C++. It spreads to shares of computers whose IP addresses start with 188.1 (addresses corresponding to hosts on the dfn.de network at the time).
34271	tcp,udp	applications	not scanned	Remuco remote control for media players
34297	udp	games	not scanned	F1 Challenge 99-02, rFactor (TCP/UDP) Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote attackers to execute arbitrary code via a packet with ID 0x80 or 0x88 to UDP port 34297, related to the buffer containing the server version number. References: [CVE-2007-4444], [BID-25358]
34312	tcp	trojan	Premium scan	Delf trojan
34313	tcp	trojan	Premium scan	Delf trojan
34324	tcp	trojans	Premium scan	Port used by BigGluck aka TN, Tiny Telnet Server.
34330	tcp	trojans	Premium scan	W32.Myfip.AB [Symantec-2005-040810-5834-99] - network aware worm that steals files from compromised computers. Sends files to a remote server on port 34330/tcp.
34343	tcp	trojan	Premium scan	Osiris trojan
34397	udp	games	not scanned	F1 Challenge 99-02, rFactor (TCP/UDP) The gMotor2 engine and multiple games implementing the affected engine, including rFactor, are vulnerable to a denial of service, caused by the improper handling of packets with IDs equal to 0x20 or 0x28. By sending a specially-crafted packet, a remote attacker could prevent a connection to UDP port 34397, resulting in a denial of service. References: [BID-25358], [CVE-2007-4445], [XFDB-36095]
34443	tcp,udp	applications	not scanned	Linksys PSUS4 print server
34444	tcp	trojan	Premium scan	Donald Dik trojan
34447	tcp	games	not scanned	F1 Challenge 99-02, rFactor (TCP/UDP)
34555	udp	trojan	Premium scan	Trin00 (DDoS attack tools) a.k.a. Trinoo and tribe flood network (TFN) use these ports: 27665/tcp (master control port), 27444/udp, 34555/udp, 35555/udp. See also CERT: IN-99-07
34567	tcp	dhanalakshmi	not scanned	dhanalakshmi.org EDI Service Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd. References: [CVE-2022-45045]
34570	udp	adaptec	not scanned	Adaptec Storage Manager
34571	tcp	serveraid	not scanned	ServeRAID Manager Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via a "bubba" local user account, an open TCP port 34571, or when a local DHCP server is unavailable, a DHCP server on the manufacturer's test network. References: [CVE-2003-0983]
34572	tcp	applications	not scanned	ServeRAID Manager IBM Director 5.10
34763	tcp	trojan	Premium scan	Infector trojan
34987	udp	games	not scanned	Rise of Nations
35000	tcp	trojan	Premium scan	Infector trojan Vgate iCar 2 WiFi OBD2 Dongle could allow a remote attacker to gain unauthorized access to the system, caused by the a flaw in the On-board Diagnostics. By accessing the port 35000 on the wireless access point of the OBD device, an attacker could exploit this vulnerability to gain access to the system. References: [CVE-2018-11478], [XFDB-143959]
35100	tcp,udp	axio-disc	not scanned	IANA registered for: Axiomatic discovery protocol
35110-35112	tcp,udp	vma	not scanned	Citrix VMAgent/GuestAgent discovery ports: 35110-35112 TCP/UDP
35332	tcp,udp	bribble	not scanned	Bribble Chat
35354	tcp	kitim	not scanned	KIT Messenger
35355	tcp	altova-lm	not scanned	Altova License Management
35355	udp	altova-lm-disc	not scanned	Altova License Management Discovery
35356	tcp	guttersnex	not scanned	Gutters Note Exchange [Squee Application Development] (IANA official)
35357	tcp	openstack-id	not scanned	OpenStack ID Service [Rackspace Hosting] (IANA official)
35555	udp	trojan	not scanned	Trin00 (DDoS attack tools) a.k.a. Trinoo and tribe flood network (TFN) use these ports: 27665/tcp (master control port), 27444/udp, 34555/udp, 35555/udp. See also CERT: IN-99-07
35600	tcp	trojan	Premium scan	SubSARI trojan [Symantec-2003-030315-2821-99]
35621	tcp,udp	urbackup	not scanned	UrBackup (open source network backup system) uses these ports: 35621-35623 TCP/UDP - client broadcasts and data backups 55413-55415 TCP - server HTTP and FastCGI ports
35622	tcp,udp	urbackup	not scanned	UrBackup (open source network backup system) uses these ports: 35621-35623 TCP/UDP - client broadcasts and data backups 55413-55415 TCP - server HTTP and FastCGI ports
35623	tcp,udp	urbackup	not scanned	UrBackup (open source network backup system) uses these ports: 35621-35623 TCP/UDP - client broadcasts and data backups 55413-55415 TCP - server HTTP and FastCGI ports
36183	tcp	trojan	Premium scan	Backdoor.Lifefournow trojan [Symantec-2004-122817-3943-99]
36311	tcp	trojans	Premium scan	W32.Mytob.FX@mm [Symantec-2005-062313-5401-99] - mass-mailing worm that opens a backdoor and listens for remote commands on port 36311/tcp, also runs an FTP server on port 10099/tcp.
36330	tcp	applications	not scanned	Folding@home Control Port
36412	sctp	s1-control	not scanned	S1-Control Plane (3GPP)
36422	sctp	x2-control	not scanned	X2-Control Plane (3GPP)
36423	sctp	slmap	not scanned	SLm Interface Application Protocol (IANA official)
36424	sctp	nq-ap	not scanned	Nq and Nq' Application Protocol (IANA official)
36443	sctp	m2ap	not scanned	IANA registered for: M2 Application Part
36444	sctp	m3ap	not scanned	IANA registered for: M3 Application Part
36462	sctp	xw-control	not scanned	Xw-Control Plane (3GPP) (IANA official)
36475	tcp,udp	beebeep	not scanned	BeeBEEP - an open source, peer to peer, LAN chat messenger uses ports 6475/tcp (chat), 6476/tcp (file transfers) and 36475/udp.
36524	tcp	febooti-aw	not scanned	IANA registered for: Febooti Automation Workshop
36567	tcp,udp	games	not scanned	Vindictus MMORPG (devCAT/Nexon) uses ports 27000-27025, 36567, and 47611 tcp/udp
36794	tcp	trojans	Premium scan	W32.Bugbear@mm [Symantec-2002-093007-2144-99] - mass-mailing worm, also spreading through network shares, affects Windows. The worm also attempts to terminate the processes of various antivirus and firewall programs and opens a backdoor service on port 36794.
36963	udp	applications	not scanned	Any of the USGN online games, most notably Counter Strike 2D multiplayer (2D clone of popular CounterStrike computer game)
36987	tcp,udp	robocode	not scanned	Robocode - an educational game, intended to help gamers learn Java programming.
37000	udp	applications	not scanned	The Cisco Video Surveillance Stream Manager firmware before 5.3, as used on Cisco Video Surveillance Services Platforms and Video Surveillance Integrated Services Platforms, allows remote attackers to cause a denial of service (reboot) via a malformed payload in a UDP packet to port 37000, related to the xvcrman process, a.k.a. Bug ID CSCsj47924. References: [CVE-2009-2045] [SECUNIA-35542]
37008	udp	applications	not scanned	TZSP intrusion detection
37020	udp	applications	Premium scan	SADP (Search Active Device Protocol) - used by Hickvision software for service discovery of online IP cameras and NVRs. SADP protocol is similar to WSD (Web Service Dynamic Discovery) and SSDP/UPnP (Simple Service Discovery Protocol/Universal Plug and Play). Hikvision SADP is subject to DDoS Reflection Amplification attack.
37031	udp	malware	not scanned	Trojan-Dropper.Win32.Delf.da / Remote Stack Buffer Overflow (UDP Datagram) - Delf.da malware listens on UDP port 37031. Adversaries who can reach the infected system can send a payload of just 999 bytes and trigger a classic stack buffer overflow. This will overwrite ECX and EIP stack registers potentially allowing control of the malwares execution flow. References: [MVID-2021-0137]
37215	tcp,udp	applications	not scanned	Huawei HG532 routers could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to the /icon/ path containing "dot dot" sequences (/../) in the port 37215 to view arbitrary files on the system. References: [CVE-2015-7254], [XFDB-107944] Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code. References: [CVE-2017-17215], [BID-102344]
37237	tcp	trojan	Premium scan	Mantis trojan
37266	tcp	trojan	Premium scan	The Killer Trojan
37472	sctp	3gpp-w1ap	not scanned	IANA registered for: W1 signalling transport
37483	tcp	gdrive-sync	not scanned	Google Drive Sync (IANA official)
37651	tcp	trojan	Premium scan	YAT
37653	tcp	trojan	Premium scan	YAT trojan
37659	tcp	applications	not scanned	Axence nVision
37777	tcp	applications	not scanned	QSee QC DVRs, QSee QC40198, QSee QC444, Digital Video Recorder hardware Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777. References: [CVE-2013-6117] An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information. References: [CVE-2017-6432], [XFDB-123213] Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device. References: [CVE-2020-5736], [XFDB-179477] Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code. References: [CVE-2020-5735], [XFDB-179480]
37810	udp	applications	not scanned	An unauthenticated attacker can perform a null pointer dereference in the DHIP Service (UDP port 37810). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111. References: [CVE-2024-52546]
37852	udp	linkproof	not scanned	Radware LinkProof Content Mgmt
37885	tcp	malware	not scanned	Backdoor.Win32.Kwak.12 / Remote Command Execution - the backdoor runs an FTP server that listens on TCP port 37885. The malware is packed using UPX which is trivial to unpack by using upx -d command, after observe various FTP commands supported using strings util, we find one interesting string entry named "execute". Turns out this will let us execute any command on the infected machine. Third-party adversaries can add a persistent backdoor account on the infected system or run any command they wish. This is easily accomplished as the malware also suffers from a authentication bypass issue reference MVID-2021-0147. References: [MVID-2021-0149] Backdoor.Win32.Kwak.12 / Authentication Bypass - the backdoor runs an FTP server that listens on TCP port 37885. The program acts like a typical FTP server and prompts for logon. However, anyone can seemingly use any combination of username and password to logon to the system and run commands. References: [MVID-2021-0147] Backdoor.Win32.Kwak.12 / Remote Denial of Service - the backdoor runs an FTP server that listens on TCP port 37885. Attackers who can reach the infected host can send a payload of around 6500 bytes using socket program to cause an unknown internal exception to crash the malware. References: [MVID-2021-0146]
37892	tcp,udp	applications	not scanned	devel/haddock 0.2
38080	tcp,udp	applications	not scanned	hpcmips, JBoss Application Server
38121	tcp,udp	applications	not scanned	Squid - a caching proxy server for the Web supporting HTTP, HTTPS, FTP, Telnet and SSL. It reduces bandwidth and improves response times by caching repeated requests. Squid is free software, intended to run on Unix-like systems but it also runs on Windows-based systems. Cabal Server Online also uses this port.
38292	tcp	applications	not scanned	Symantec AntiVirus Corporate Edition could allow a remote attacker to gain elevated privileges on the system, caused by a vulnerability in the Intel Alert Handler service (hndlrsvc.exe). By establishing a connection to TCP port 38292, a remote attacker could exploit this vulnerability to execute arbitrary commands on the system with SYSTEM-level privileges. References: [BID-41959]
38293	udp	NortonAntiVirus	not scanned	Norton Anti-Virus host discovery
38412	sctp	ng-control	not scanned	IANA registered for: NG Control Plane (3GPP)
38422	sctp	xn-control	not scanned	IANA registered for: Xn Control Plane (3GPP)
38462	sctp	e1-interface	not scanned	IANA registered for: E1 signalling transport (3GPP)
38472	sctp	f1-control	not scanned	IANA registered for: F1 Control Plane (3GPP)
38628	udp	games	not scanned	Heroes of Might and Magic III, developer: New World Computing
38638	tcp	psqlmws	not scanned	Premier SQL Middleware Server (IANA official)
38741	tcp	trojan	Premium scan	CyberSpy trojan
38742	tcp	trojan	Premium scan	CyberSpy
38751	tcp	applications	not scanned	A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the attack traffic persists. References: [CVE-2024-20390]
38800	tcp	sruth	not scanned	Sruth is a service for the distribution of routinely- generated but arbitrary files based on a publish/subscribe distribution model and implemented using a peer-to-peer transport mechanism [University Corporation for Atmospheric Research] (IANA official)
38865	tcp	secrmmsafecopya	not scanned	Security approval process for use of the secRMM SafeCopy program [Squadra Technologies] (IANA official)
38920	tcp	applications	not scanned	RenderDoc is vulnerable to a heap-based buffer overflow, caused by an integer overflow in librenderdoc.so's server thread on TCP port 38920. By sending a specially crafted handshake packet using the client name parameter, a remote attacker could overflow a buffer and execute arbitrary code on the system. References: [CVE-2023-33864], [XFDB-257286] RenderDoc is vulnerable to a heap-based buffer overflow, caused by an integer overflow in librenderdoc.so's server thread on TCP port 38920. By sending a specially crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system. References: [CVE-2023-33863], [XFDB-257288]
39063	tcp	vroa	not scanned	Children's hearing test/Telemedicine (IANA official)
39300	udp	applications	not scanned	America's Army is vulnerable to a denial of service, caused by the improper handling of queries. By sending a specially-crafted packet to UDP port 39300, a remote attacker could cause the server to enter into an error message loop and consume an overly large amount of CPU resources. References: [XFDB-52459], [BID-35749]
39500	tcp,udp	applications	not scanned	An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the 'sync' operation, leading to arbitrary deletion of cameras. An attacker can send an HTTP request to trigger this vulnerability. References: [CVE-2018-3918] An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability. References: [CVE-2018-3911]
39507	tcp	trojan	Premium scan	Busters trojan
39581	tcp	trojans	Premium scan	Backdoor.WinShell.50.b [Symantec-2003-081110-5211-99] - remote access trojan, affects Windows, listens on port 39581. It is a variant of Backdoor.WinShell.50 [Symantec-2003-080611-0047-99] (port 8719) and usually packed along with Trojan.Stealther.B [Symantec-2003-080716-1231-99].
39780	tcp	trojans	Premium scan	Backdoor.Nibu.O [Symantec-2005-101017-0741-99] - a backdoor trojan that also runs a keylogger. Opens a backdoor and listens for remote commands on port 39780/tcp. Also logs information and sends captured keystrokes to predetermined websites/emails.
39872	tcp,udp	trojans	not scanned	Backdoor.Cuhmap [Symantec-2002-090617-5543-99] - a backdoor trojan horse that gives an attacker unauthorized access to an infected computer. By default it opens port 39872 on the compromised computer.
39889	udp	applications	not scanned	An issue was discovered on the D-Link DWR-932B router. HELODBG on port 39889 (UDP) launches the "/sbin/telnetd -l /bin/sh" command. References: [CVE-2016-10178], [BID-95877]
39999	tcp	trojans	Members scan	Trojan.Mitglieder.C [Symantec-2004-012012-0813-99] - Mail Relay trojan, affects Windows, listens on port 39999/tcp. Opens a mail relay on your computer (allowing others to use it to send unsolicited commercial email). The Trojan also downloads and executes PWSteal.Ldpinch.
39999	udp	applications	not scanned	Symantec Endpoint Protection (SEP). Communication between the SEP clients and the Enforcer. This port is used for authentication of clients by the Enforcer. Sygate Enforcer contains a flaw that may allow a remote denial of service. The issue is triggered when a remote attacker sends a specially crafted UDP packet from source port 39999 to destination source port 39999 on the Enforcer system, and will result in loss of availability for the Enforcer system. References: [CVE-2003-0931], [XFDB-16949]
40000	tcp,udp	safetynetp	not scanned	SafetyNET p Real-time Industrial Ethernet protocol (IANA official)

Vulnerabilities listed: 100 (some use multiple ports)

1 |....| 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55