{
  "port": 2401,
  "protocol": "tcp",
  "service": "CVS pserver",
  "oneLiner": "CVS's password-authenticating server — version control from before SSH was assumed.",
  "whatItIs": "The CVS manual documents 2401 as the default pserver port, historically wired up through inetd or xinetd running `cvs pserver`. A client sends the repository root, username, and password, and gets read/write access to the repository. The manual is blunt about the security: the password is only trivially scrambled, offering no protection against anyone who can sniff packets, and it recommends a separate CVS password file so people do not expose their real account passwords. Today it turns up on legacy source servers and anonymous read-only mirrors of old projects.",
  "exposure": {
    "verdict": "never",
    "note": "The CVS manual itself says the scrambling stops inadvertent compromise and nothing more; authenticated pserver on a public IP hands over credentials. Anonymous read-only mirrors are the only defensible case, and even then prefer ssh transport."
  },
  "checkCommand": "nc -v TARGET 2401",
  "links": [
    {
      "title": "CVS Manual — Password authentication server (port 2401, inetd/xinetd setup)",
      "url": "https://www.gnu.org/software/trans-coord/manual/cvs/html_node/Password-authentication-server.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 2401 (cvspserver)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2401",
      "kind": "iana"
    }
  ],
  "ianaName": "cvspserver"
}