{
  "port": 3221,
  "protocol": "tcp",
  "service": "Junos XML protocol, cleartext (xnm-clear-text)",
  "oneLiner": "Juniper's XML management protocol in the clear — full device configuration over an unencrypted socket.",
  "whatItIs": "IANA registers 3221 as `xnm-clear-text`, \"XML NM over TCP\", and that is exactly Juniper's use: configuring `set system services xnm-clear-text` makes a Junos device accept Junos XML protocol (JUNOScript) sessions on TCP 3221 with no transport encryption, while the TLS variant `xnm-ssl` lives on 3220. A client logs in with a device account and can then read and change the entire configuration in XML. Juniper's documentation offers connection-limit and rate-limit knobs, and notes the statement is unavailable on Junos-FIPS and discouraged in Common Criteria environments. An open 3221 means a router or switch is taking management sessions in cleartext.",
  "exposure": {
    "verdict": "never",
    "note": "Credentials and the full device configuration cross the wire unencrypted; use NETCONF over SSH (830) or xnm-ssl instead, and never expose either off the management network."
  },
  "checkCommand": "nc -v TARGET 3221",
  "links": [
    {
      "title": "Juniper — xnm-clear-text (edit system services)",
      "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/xnm-clear-text-edit-system.html",
      "kind": "official-docs"
    },
    {
      "title": "Juniper — Configure clear-text or SSL Service for Junos XML Protocol Client Applications",
      "url": "https://www.juniper.net/documentation/us/en/software/junos/junos-xml-protocol/topics/task/remote-access-junoscript-client-applications-clear-text-ssl.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}