3 ms·
I must be missing something, but why are all these routers publicly listening on port 5431?
by trulyrandom 8y ago
I must be missing something, but why are all these routers publicly listening on port 5431?
- mr_toad 8y agoPorts 5431 and 1900 are used for UPnP. I can’t think of any good reason they should be listening on an external interface, but maybe the port scanning is happening on the inside.
- trulyrandom 8y agoThat's the thing, it looks like they are listening externally: https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%20UPnP%2F1.0%20Proc%2FVer https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%.... I tried a couple of those IPs and can reach all of them on 5431.
- rthille 8y agoYeah, DNS rebinding attacks can allow malicious Javascript running inside the network attack the router from the LAN side.