Internet-Security.com TCP port 789 details

Red Lion Controls HMIs (e.g., G3 and Graphite series) expose a Crimson programming/download service on TCP port 789, used by the Crimson 2/3 engineering software to upload/download project files and firmware.
Many internet-exposed hosts on 789/tcp banner as Red Lion/Crimson services, confirming this real-world use in industrial environments.
Security note: Attackers have scanned and targeted exposed Red Lion Crimson programming services; if left open, unauthorized users could potentially upload new configurations or alter device behavior, so operators restrict 789/tcp to trusted engineering networks.

TCP 789