{
  "port": 5989,
  "protocol": "tcp",
  "service": "WBEM CIM-XML over HTTPS",
  "oneLiner": "The TLS port for CIM-XML — the usual way hardware monitoring tools reach a CIM object manager.",
  "whatItIs": "IANA registers 5989 as `wbem-https`, CIM Operations over HTTP carried on TLS. This is the port SFCB listens on by default (SUSE documents 5989 as the default secure port), and the one used by OpenPegasus and by CIM providers baked into server BMCs, storage arrays, and hypervisor management agents. Finding it open usually means a physical server or appliance is publishing its hardware inventory and health model to a monitoring system.",
  "exposure": {
    "verdict": "never",
    "note": "It is an out-of-band-style management interface with Basic auth inside the TLS session and often a self-signed certificate — reachable from the monitoring network only, never the internet."
  },
  "checkCommand": "openssl s_client -connect TARGET:5989 </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer",
  "links": [
    {
      "title": "DMTF DSP0200 — CIM Operations over HTTP",
      "url": "https://www.dmtf.org/sites/default/files/standards/documents/DSP0200_1.4.0.pdf",
      "kind": "spec"
    },
    {
      "title": "SUSE Linux Enterprise Server — Web-Based Enterprise Management using SFCB",
      "url": "https://documentation.suse.com/sles/15-SP6/html/SLES-all/cha-wbem.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5989 (wbem-https)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5989",
      "kind": "iana"
    }
  ]
}