{
  "port": 16992,
  "protocol": "tcp",
  "service": "Intel AMT SOAP/HTTP",
  "oneLiner": "The cleartext web and SOAP interface of Intel Active Management Technology — out-of-band control of the machine itself.",
  "whatItIs": "IANA registers 16992 to Intel as amt-soap-http. It is served by the Management Engine, not the operating system, so it answers while the machine is asleep, unprovisioned or freshly reinstalled, and it exposes power control, boot device selection, serial-over-LAN and (with 16994/16995) KVM redirection. Nmap fingerprints it easily because the HTTP response identifies Intel AMT. Its most famous appearance is CVE-2017-5689 (INTEL-SA-00075), an authentication bypass that let anyone who could reach 16992 take over the box.",
  "exposure": {
    "verdict": "never",
    "note": "Cleartext HTTP with Digest auth in front of full out-of-band hardware control. Firmware-level management belongs on an isolated management VLAN; internet-facing AMT is a takeover waiting for a firmware CVE."
  },
  "checkCommand": "curl -sI --max-time 5 http://TARGET:16992/",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 16992 (amt-soap-http)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=16992",
      "kind": "iana"
    },
    {
      "title": "INTEL-SA-00075 — AMT/ISM/SBT escalation of privilege (CVE-2017-5689)",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html",
      "kind": "official-docs"
    },
    {
      "title": "Intel Open AMT Cloud Toolkit",
      "url": "https://github.com/open-amt-cloud-toolkit/open-amt-cloud-toolkit",
      "kind": "github"
    }
  ]
}