# WHATPORT(52869)

## NAME

port 52869 — Realtek SDK miniigd UPnP SOAP (consumer routers) — The Realtek SDK UPnP SOAP endpoint behind CVE-2014-8361 — a decade-old router RCE botnets still spray.

Protocol: TCP  
IANA registry

## DESCRIPTION

Many consumer routers and IP cameras built on the Realtek SDK run `miniigd`, the vendor's UPnP Internet Gateway Device daemon, with its SOAP interface bound to TCP 52869. CVE-2014-8361 is a command injection in that service: "The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023." The public Metasploit module for it hardcodes `Opt::RPORT(52869) # port of UPnP SOAP webinterface`, and Mirai-family IoT botnets have carried the exploit for years, which is why nmap-services records it open on 0.076% of scanned hosts — high for a port with no registration, though a number of ports in the dynamic range score higher. The port itself is unassigned — RFC 6335 forbids IANA registrations above 49151 — so its entire reputation comes from this one vulnerable daemon.

## EXPOSURE

**Do not expose.** An unauthenticated SOAP endpoint with a decade of in-the-wild remote code execution. UPnP is a LAN protocol and should never be reachable from the WAN; if your router exposes this, patch or replace it.

## CHECK

```sh
curl -s -m 5 -D - http://TARGET:52869/ -o /dev/null
```

## SEE ALSO

- docs — [NVD — CVE-2014-8361 (Realtek SDK miniigd SOAP remote code execution)](https://nvd.nist.gov/vuln/detail/CVE-2014-8361) (nvd.nist.gov)
- source — [rapid7/metasploit-framework — Realtek SDK miniigd SOAP module (RPORT 52869)](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/realtek_miniigd_upnp_exec_noauth.rb) (github.com)
- iana — [IANA port registry — search 52869 (no assignment)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=52869) (iana.org)
- spec — [RFC 6335 — IANA Procedures for Port Number Registration (Dynamic/Private range 49152-65535)](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- source — [nmap-services — Nmap's port frequency database](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/52869/> · JSON: <https://whatport.net/52869.json> · full dataset: <https://whatport.net/ports.json>