{
  "port": 6481,
  "protocol": "both",
  "service": "Sun Service Tags",
  "oneLiner": "Sun/Oracle Service Tags agent — answers with the machine's serial number and hardware inventory.",
  "whatItIs": "IANA registers 6481 as servicetags, assigned to Peter Schow at Sun. The Service Tags agent shipped with Solaris and several Sun/Oracle products to support asset discovery, and it answers unauthenticated queries with system details: OS release, hostname, architecture, platform, manufacturer, serial number, hostid, RAM, and CPU counts. Nmap ships a servicetags NSE script that does exactly this over UDP 6481. Finding it open means an older Solaris or Sun-derived stack that still has the discovery listener enabled.",
  "exposure": {
    "verdict": "never",
    "note": "It hands out serial numbers, hostids, and a full hardware profile with no authentication — precise inventory data for an attacker planning the next step. Disable the agent or firewall it to the asset-management server."
  },
  "checkCommand": "nmap -sU -p 6481 --script=servicetags TARGET",
  "links": [
    {
      "title": "Nmap NSE — servicetags (Sun Service Tags, UDP 6481)",
      "url": "https://nmap.org/nsedoc/scripts/servicetags.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6481 (servicetags)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6481",
      "kind": "iana"
    }
  ]
}