The cleartext web and SOAP interface of Intel Active Management Technology — out-of-band control of the machine itself.
IANA registers 16992 to Intel as amt-soap-http. It is served by the Management Engine, not the operating system, so it answers while the machine is asleep, unprovisioned or freshly reinstalled, and it exposes power control, boot device selection, serial-over-LAN and (with 16994/16995) KVM redirection. Nmap fingerprints it easily because the HTTP response identifies Intel AMT. Its most famous appearance is CVE-2017-5689 (INTEL-SA-00075), an authentication bypass that let anyone who could reach 16992 take over the box.
Do not expose
Cleartext HTTP with Digest auth in front of full out-of-band hardware control. Firmware-level management belongs on an isolated management VLAN; internet-facing AMT is a takeover waiting for a firmware CVE.
$ curl -sI --max-time 5 http://TARGET:16992/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.