{
  "port": 52869,
  "protocol": "tcp",
  "service": "Realtek SDK miniigd UPnP SOAP (consumer routers)",
  "oneLiner": "The Realtek SDK UPnP SOAP endpoint behind CVE-2014-8361 — a decade-old router RCE botnets still spray.",
  "whatItIs": "Many consumer routers and IP cameras built on the Realtek SDK run `miniigd`, the vendor's UPnP Internet Gateway Device daemon, with its SOAP interface bound to TCP 52869. CVE-2014-8361 is a command injection in that service: \"The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.\" The public Metasploit module for it hardcodes `Opt::RPORT(52869) # port of UPnP SOAP webinterface`, and Mirai-family IoT botnets have carried the exploit for years, which is why nmap-services records it open on 0.076% of scanned hosts — high for a port with no registration, though a number of ports in the dynamic range score higher. The port itself is unassigned — RFC 6335 forbids IANA registrations above 49151 — so its entire reputation comes from this one vulnerable daemon.",
  "exposure": {
    "verdict": "never",
    "note": "An unauthenticated SOAP endpoint with a decade of in-the-wild remote code execution. UPnP is a LAN protocol and should never be reachable from the WAN; if your router exposes this, patch or replace it."
  },
  "checkCommand": "curl -s -m 5 -D - http://TARGET:52869/ -o /dev/null",
  "links": [
    {
      "title": "NVD — CVE-2014-8361 (Realtek SDK miniigd SOAP remote code execution)",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8361",
      "kind": "official-docs"
    },
    {
      "title": "rapid7/metasploit-framework — Realtek SDK miniigd SOAP module (RPORT 52869)",
      "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/realtek_miniigd_upnp_exec_noauth.rb",
      "kind": "github"
    },
    {
      "title": "IANA port registry — search 52869 (no assignment)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=52869",
      "kind": "iana"
    },
    {
      "title": "RFC 6335 — IANA Procedures for Port Number Registration (Dynamic/Private range 49152-65535)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "nmap-services — Nmap's port frequency database",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}