WHATPORT(16992) whatport.net WHATPORT(16992)
16992

Intel AMT SOAP/HTTP

The cleartext web and SOAP interface of Intel Active Management Technology — out-of-band control of the machine itself.

TCP IANA registry

Description

IANA registers 16992 to Intel as amt-soap-http. It is served by the Management Engine, not the operating system, so it answers while the machine is asleep, unprovisioned or freshly reinstalled, and it exposes power control, boot device selection, serial-over-LAN and (with 16994/16995) KVM redirection. Nmap fingerprints it easily because the HTTP response identifies Intel AMT. Its most famous appearance is CVE-2017-5689 (INTEL-SA-00075), an authentication bypass that let anyone who could reach 16992 take over the box.

Exposed to the internet?

Do not expose

Cleartext HTTP with Digest auth in front of full out-of-band hardware control. Firmware-level management belongs on an isolated management VLAN; internet-facing AMT is a takeover waiting for a firmware CVE.

Check it yourself

$ curl -sI --max-time 5 http://TARGET:16992/

See also

Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.

Get Beige Box →

also available as JSON · Markdown

Corrections or a missing port? Reply @rimrocksystems.