3 ms·

I never thought to nmap my own router until reading this. PORT STATE SERVICE 53/tcp open domain 80/tcp open http 631/tcp open ipp 500

I never thought to nmap my own router until reading this. PORT STATE SERVICE 53/tcp open domain 80/tcp open http 631/tcp open ipp 5000/tcp open upnp 7777/tcp open cbt 20005/tcp open btx Now begins the three-hours-and-counting rabbit hole of trying to figure out what the hell is running on ports 7777 and 20005. Or why UPNP is apparently running, despite UPNP being explicitly disabled on the Netgear router's admin page.

manifoldgeo 7y ago
Maybe it's a remote administration port for your ISP. I have a router provided by Froniter, formerly Verizon FiOS, where port 4567 is always open and cannot be closed with a firewall rule from the router's web UI (grayed out). After some googling I found out that it's their maintenance port: https://www.speedguide.net/port.php?port=4567 https://www.speedguide.net/port.php?port=4567 For a while I had my own OpenWRT router in place of the ISP one, but I think they got wise to it and blocked the MAC. I changed it to match the ISP router's MAC address, but it only worked for about 3 minutes before being blocked again.
- AdmiralAsshat 7y ago
  I bought both my modem and my router, so I'd be a little incredulous if my ISP had somehow forced a port open on it. The 20005 one may be some port that NetGear uses for its USB Printing, I've found some articles that mention it. It also struck me that I hit it with nmap using the LAN IP, so perhaps these are only open within the network. I probably need to hit the external IP of the router to see what is externally open. ShieldsUP! didn't show anything unusual.[1] EDIT: Disclosure of a vulnerability regarding port 20005[2], and Netgear confirming that it does affect my router[3], but should have been fixed. I assume the "fix" was fixing the buffer overflow vulnerability, rather than closing the port altogether. [1] https://www.grc.com/x/ne.dll?bh0bkyd2 https://www.grc.com/x/ne.dll?bh0bkyd2 [2] https://www.kb.cert.org/vuls/id/177092/ https://www.kb.cert.org/vuls/id/177092/ [3] https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-Advisory-ReadySHARE https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-A...

manifoldgeo 7y ago

Maybe it's a remote administration port for your ISP. I have a router provided by Froniter, formerly Verizon FiOS, where port 4567 is always open and cannot be closed with a firewall rule from the router's web UI (grayed out). After some googling I found out that it's their maintenance port: https://www.speedguide.net/port.php?port=4567 https://www.speedguide.net/port.php?port=4567 For a while I had my own OpenWRT router in place of the ISP one, but I think they got wise to it and blocked the MAC. I changed it to match the ISP router's MAC address, but it only worked for about 3 minutes before being blocked again.

AdmiralAsshat 7y ago
I bought both my modem and my router, so I'd be a little incredulous if my ISP had somehow forced a port open on it. The 20005 one may be some port that NetGear uses for its USB Printing, I've found some articles that mention it. It also struck me that I hit it with nmap using the LAN IP, so perhaps these are only open within the network. I probably need to hit the external IP of the router to see what is externally open. ShieldsUP! didn't show anything unusual.[1] EDIT: Disclosure of a vulnerability regarding port 20005[2], and Netgear confirming that it does affect my router[3], but should have been fixed. I assume the "fix" was fixing the buffer overflow vulnerability, rather than closing the port altogether. [1] https://www.grc.com/x/ne.dll?bh0bkyd2 https://www.grc.com/x/ne.dll?bh0bkyd2 [2] https://www.kb.cert.org/vuls/id/177092/ https://www.kb.cert.org/vuls/id/177092/ [3] https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-Advisory-ReadySHARE https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-A...