{
  "port": 5988,
  "protocol": "tcp",
  "service": "WBEM CIM-XML over HTTP",
  "oneLiner": "A CIM object manager's cleartext port — hardware and system management over CIM-XML.",
  "whatItIs": "IANA registers 5988 as `wbem-http`, the default port for CIM Operations over HTTP (DMTF DSP0200), where XML-encoded CIM method calls are POSTed to a CIM object manager. Real listeners are SFCB, OpenPegasus, and the CIM providers embedded in server hardware and hypervisors — this is how vendor tools read fan speeds, PSU state, and RAID health. On SUSE's SFCB the HTTP port is disabled by default (`enableHttp` is false) and documented as a debugging aid only, which tells you how the maintainers view it.",
  "exposure": {
    "verdict": "never",
    "note": "CIM-XML over plain HTTP authenticates with HTTP Basic, so credentials for a hardware management interface cross the wire in cleartext. Use 5989 instead, and keep both on a management network."
  },
  "checkCommand": "curl -si -m 5 http://TARGET:5988/cimom | head -1",
  "links": [
    {
      "title": "DMTF DSP0200 — CIM Operations over HTTP",
      "url": "https://www.dmtf.org/sites/default/files/standards/documents/DSP0200_1.4.0.pdf",
      "kind": "spec"
    },
    {
      "title": "SUSE Linux Enterprise Server — Web-Based Enterprise Management using SFCB",
      "url": "https://documentation.suse.com/sles/15-SP6/html/SLES-all/cha-wbem.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5988 (wbem-http)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5988",
      "kind": "iana"
    }
  ]
}