Internet-Security raven logo internet-security.com

TCP 52869

ProtocolTCP
Port52869
Labels

Synopsis

  • TCP port 52869 is commonly used by the UPnP Internet Gateway Device (IGD) SOAP service implemented in the Realtek SDK “miniigd” on many consumer routers and IoT gateways (Realtek eCos/SDK-based firmware).
  • The service typically exposes UPnP control URLs (e.g., /upnp/control/WANIPConn1) over HTTP on this port.
  • Real-world presence: numerous low-cost routers and CPE devices built on Realtek chipsets from various OEM/ODM brands deploy this “miniigd” service on 52869/TCP.
  • Security/abuse: This port/service has been widely targeted for remote code execution in Realtek UPnP implementations (e.g., CVE-2014-8361 command injection in SOAP parameters like NewInternalClient/AddPortMapping), and leveraged by Mirai/Gafgyt variants and mass scanners to conscript devices into botnets.

Observed activity

Last 30 days Detailed chart

More information