# WHATPORT(16992)

## NAME

port 16992 — Intel AMT SOAP/HTTP — The cleartext web and SOAP interface of Intel Active Management Technology — out-of-band control of the machine itself.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 16992 to Intel as amt-soap-http. It is served by the Management Engine, not the operating system, so it answers while the machine is asleep, unprovisioned or freshly reinstalled, and it exposes power control, boot device selection, serial-over-LAN and (with 16994/16995) KVM redirection. Nmap fingerprints it easily because the HTTP response identifies Intel AMT. Its most famous appearance is CVE-2017-5689 (INTEL-SA-00075), an authentication bypass that let anyone who could reach 16992 take over the box.

## EXPOSURE

**Do not expose.** Cleartext HTTP with Digest auth in front of full out-of-band hardware control. Firmware-level management belongs on an isolated management VLAN; internet-facing AMT is a takeover waiting for a firmware CVE.

## CHECK

```sh
curl -sI --max-time 5 http://TARGET:16992/
```

## SEE ALSO

- iana — [IANA Service Name and Transport Protocol Port Number Registry — 16992 (amt-soap-http)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=16992) (iana.org)
- docs — [INTEL-SA-00075 — AMT/ISM/SBT escalation of privilege (CVE-2017-5689)](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html) (intel.com)
- source — [Intel Open AMT Cloud Toolkit](https://github.com/open-amt-cloud-toolkit/open-amt-cloud-toolkit) (github.com)

---

HTML: <https://whatport.net/16992/> · JSON: <https://whatport.net/16992.json> · full dataset: <https://whatport.net/ports.json>