{
  "port": 5987,
  "protocol": "tcp",
  "service": "wbem-rmi (WBEM over Java RMI)",
  "oneLiner": "A WBEM-over-RMI registration from the DMTF port block, with no meaningful deployment behind it.",
  "whatItIs": "IANA assigns 5987 to `wbem-rmi`, registered by Jim Davis alongside the rest of the WBEM block (5985-5990). It was intended for a Java RMI binding to a CIM object manager — the approach Sun's WBEM Services used — but CIM-XML over HTTP on 5988/5989 and WS-Management on 5985/5986 are what implementations actually settled on. A listener here is unusual; when it appears it is typically a Java management agent that opened the whole DMTF block, or an unrelated application on a free port.",
  "exposure": {
    "verdict": "never",
    "note": "Java RMI endpoints deserialize remote objects and have a long history of remote-code-execution flaws, and this one sits in a hardware-management block — keep it off any untrusted network."
  },
  "checkCommand": "nmap -Pn -sV -p 5987 TARGET",
  "links": [
    {
      "title": "IANA port registry — 5987 (wbem-rmi)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5987",
      "kind": "iana"
    }
  ]
}