Nearly always ADB on an Android device — an unauthenticated shell if the device is old enough.
Running adb tcpip 5555 puts an Android device's debug bridge on the network, and 5555 is the classic default that phones, TV boxes, and dev boards land on. On pre-Android-11 devices there is no pairing code and no on-device prompt, so anyone who reaches the port can run adb connect and get a shell, install packages, and pull data; that gap is what the 2018 ADB.Miner worm mass-exploited. IANA registers the port as personal-agent and flags known unauthorised use. HP/HPE Data Protector also used 5555 for its Inet client service before version 10 moved to 5565.
Do not expose
An internet-reachable 5555 on a legacy Android device is a full compromise waiting to happen — no authentication stands between the port and a root-capable shell.
$ adb connect TARGET:5555Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.