{
  "port": 5555,
  "protocol": "tcp",
  "service": "Android Debug Bridge over TCP/IP",
  "oneLiner": "Nearly always ADB on an Android device — an unauthenticated shell if the device is old enough.",
  "whatItIs": "Running adb tcpip 5555 puts an Android device's debug bridge on the network, and 5555 is the classic default that phones, TV boxes, and dev boards land on. On pre-Android-11 devices there is no pairing code and no on-device prompt, so anyone who reaches the port can run adb connect and get a shell, install packages, and pull data; that gap is what the 2018 ADB.Miner worm mass-exploited. IANA registers the port as personal-agent and flags known unauthorised use. HP/HPE Data Protector also used 5555 for its Inet client service before version 10 moved to 5565.",
  "exposure": {
    "verdict": "never",
    "note": "An internet-reachable 5555 on a legacy Android device is a full compromise waiting to happen — no authentication stands between the port and a root-capable shell."
  },
  "checkCommand": "adb connect TARGET:5555",
  "links": [
    {
      "title": "Android — adb, connecting over Wi-Fi",
      "url": "https://developer.android.com/tools/adb",
      "kind": "official-docs"
    },
    {
      "title": "Data Protector — port usage (Inet)",
      "url": "https://docs.microfocus.com/doc/data_protector/24.1/portusage",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5555 (personal-agent)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5555",
      "kind": "iana"
    }
  ]
}