The Realtek SDK UPnP SOAP endpoint behind CVE-2014-8361 — a decade-old router RCE botnets still spray.
Many consumer routers and IP cameras built on the Realtek SDK run miniigd, the vendor's UPnP Internet Gateway Device daemon, with its SOAP interface bound to TCP 52869. CVE-2014-8361 is a command injection in that service: "The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023." The public Metasploit module for it hardcodes Opt::RPORT(52869) # port of UPnP SOAP webinterface, and Mirai-family IoT botnets have carried the exploit for years, which is why nmap-services records it open on 0.076% of scanned hosts — high for a port with no registration, though a number of ports in the dynamic range score higher. The port itself is unassigned — RFC 6335 forbids IANA registrations above 49151 — so its entire reputation comes from this one vulnerable daemon.
Do not expose
An unauthenticated SOAP endpoint with a decade of in-the-wild remote code execution. UPnP is a LAN protocol and should never be reachable from the WAN; if your router exposes this, patch or replace it.
$ curl -s -m 5 -D - http://TARGET:52869/ -o /dev/nullSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.