The same VNC web-viewer port as 5800, one display up: display :1.
VNC servers place their HTTP viewer listener at 5800 plus the display number, so 5801 is display :1 — the first display a Linux vncserver normally creates for a user. The page it serves is a Java applet that connects onward to the matching RFB port, 5901. IANA has never assigned 5801; seeing it open means a VNC server with a per-user display is running, and 5901 is almost certainly open too.
Do not expose
Same problem as 5800: it publicly identifies a VNC server whose RFB authentication is weak and unencrypted. Keep both this and 5901 on the loopback or behind an SSH tunnel.
$ curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5801/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.