2083

Port 2083/tcp is registered with IANA as radsec with the description "Secure Radius Service," assignee [IESG], contact [IETF_Chair], registration date 2005-05, and reference RFC 6614 (it is dual-registered, with 2083/udp also carrying the radsec name but referencing RFC 7360 for RADIUS-over-DTLS). RFC 6614 (May 2012) defines RADIUS over TLS, wrapping the entire RADIUS payload in a TLS stream over TCP/2083 so that the legacy plaintext-with-MD5 transport is replaced by X.509 certificate-based mutual authentication; the RADIUS shared secret is fixed to the literal string "radsec" because TLS subsumes its integrity role. The IANA registry itself notes that TCP/2083 was assigned for an earlier "RadSec" implementation (Open Systems Consultants' Radiator) before the RFC issued, and RFC 6614 Appendix A documents that compatibility. The primary real-world deployment is roaming federation infrastructure such as eduroam. Separately and unofficially, the same port is the long-standing cPanel & WHM HTTPS interface — administrators reach the hosting control panel at https://hostname:2083 — and this vendor convention, not the RadSec role, is what drives nearly all of the port's internet scanning exposure. That exposure is significant: the Brutus botnet (documented from March 2024, later tied by EclecticIQ to a Black Basta ransomware affiliate) targets cPanel ports 2082/2083, and CVE-2026-41940 (April 2026, critical) was an unauthenticated cPanel/WHM authentication bypass exploited in the wild for roughly 64 days before patching, with Rapid7 estimating ~1.5 million exposed instances. For RADIUS deployments the port is comparatively low-exposure because mutual TLS makes unauthenticated access structurally hard; for cPanel it is a routine credential-stuffing and brute-force target that should be IP-restricted or placed behind a VPN.

IANA assignment

radsec — "Secure Radius Service"; reference RFC 6614; assignee [IESG], contact [IETF_Chair]; registration date 2005-05; dual-registered 2083/tcp + 2083/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Dual registration

2083/udp also radsec (Secure Radius Service), assignee [IESG], contact [IETF_Chair], registration 2005-05, modification 2014-07-14, reference RFC 7360 (RADIUS over DTLS) [Confirmed] — IANA registry CSV

Assignment note

TCP/2083 was previously assigned for an early "RadSec" implementation prior to the RFC; that implementation can be configured to be RFC-6614 compatible (see RFC 6614 Appendix A) [Confirmed] — IANA registry CSV; RFC 6614 App. A

Related ports

2082/tcp (cPanel HTTP), 2087/tcp (WHM HTTPS), 2095/2096 (webmail); RADIUS auth 1812/udp; legacy RadSec/RADIUS context

Primary use

RadSec — RADIUS over TLS per RFC 6614 (May 2012); RADIUS payload carried in a TLS stream with X.509 mutual auth; default destination TCP/2083; used in roaming federations such as eduroam

Other/unofficial uses

de-facto cPanel & WHM HTTPS interface (https://hostname:2083) by long-standing vendor convention — no IANA/RFC reference exists for this binding

Common software

RadSec/RADIUS-over-TLS network access servers, RADIUS proxies, eduroam federation infrastructure, Radiator (earliest known implementation); cPanel context: cPanel & WHM web hosting control panel

Security implications

scanning exposure is driven by the cPanel binding, not RadSec. Brutus botnet (from March 2024) targets cPanel 2082/2083, linked by EclecticIQ to a Black Basta RaaS affiliate (March 2025). CVE-2026-41940 (April 2026, critical) — unauthenticated cPanel/WHM auth bypass via session-cookie/header manipulation, all versions after v11.40, entry ports 2083/2087/2095/2096; exploited in the wild ~Feb 23 2026, patched Apr 28 2026 (~64-day window). Rapid7: ~1.5M exposed cPanel instances; Shadowserver: ~44,000 scanning/exploitation IPs post-disclosure. RadSec itself is low-exposure due to mutual TLS

Typically seen on

cPanel-managed web hosting servers (HTTPS panel); RADIUS/eduroam federation gateways

Analyst note

An open 2083/tcp is far more often a cPanel HTTPS panel than a RadSec endpoint; treat exposed cPanel logins as brute-force/credential-stuffing targets and restrict access. RadSec endpoints should present a TLS certificate and require client-cert mutual auth.

Port 2083/udp is registered with IANA as radsec with the description "Secure Radius Service," assignee [IESG], contact [IETF_Chair], a registration date of 2005-05, and reference [RFC7360]. It is the IANA-assigned default destination port for RADIUS over DTLS (Datagram Transport Layer Security), formally specified in RFC 7360 (September 2014). RADIUS/DTLS wraps standard RADIUS packets inside a DTLS session, adding encryption and mutual certificate-based authentication on top of UDP transport without altering the underlying RADIUS packet format — a direct response to legacy RADIUS/UDP's weak MD5-based obfuscation and lack of confidentiality. The port number was not new in 2014: IANA had already assigned 2083 (both TCP and UDP) for an early "RadSec" implementation of RADIUS over a secure transport before either standards-track RFC was issued, which the registry records explicitly in its assignment notes. RFC 7360 standardized the UDP/DTLS use of the port. Importantly, all RADIUS traffic — authentication, accounting, and dynamic authorization — shares port 2083; there are no separate sub-ports as there are in the legacy 1812/1813 split. The port is dual-registered on TCP as well: 2083/tcp is radsec for RADIUS over TLS, assignee [IESG], registration 2005-05, reference [RFC6614]. For an analyst the key distinction is that the high-exposure cPanel SSL hosting control panel that is widely scanned on port 2083 uses TCP, not UDP — the UDP assignment is exclusively RADIUS/DTLS. Legitimate 2083/udp traffic is an enterprise-internal or inter-site authentication protocol that should never face arbitrary Internet hosts; because it requires mutual X.509 certificate authentication, its attack surface is materially smaller than legacy RADIUS/UDP, and scanning interest in 2083/udp is comparatively low versus 1812/udp and 1645/udp.

IANA assignment

radsec — "Secure Radius Service"; reference [RFC7360]; assignee [IESG]; contact [IETF_Chair]; registration date 2005-05; modification date 2014-07-14 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Assignment note

the port was already assigned for an early "RadSec" implementation of RADIUS over a secure transport before the RFC was issued; RFC 7360 standardized the UDP/DTLS use [Confirmed] — IANA registry assignment notes

Primary use

RADIUS over DTLS (RADIUS/DTLS) — encapsulates standard RADIUS packets inside a DTLS session for encryption and mutual certificate-based authentication (RFC 7360, September 2014)

Common software

Cisco IOS/IOS-XE, Juniper Junos, FreeRADIUS (DTLS-capable builds), Aruba/HPE infrastructure, enterprise NAC platforms (SecureW2, Portnox); deployed on NAS devices and RADIUS servers in 802.1X / enterprise Wi-Fi

Security implications

enterprise-internal protocol, should never be Internet-exposed; mutual X.509 certificate auth narrows attack surface versus legacy RADIUS/UDP (MD5-obfuscation, no encryption); scanning interest on 2083/udp is low relative to legacy RADIUS ports (1812/udp, 1645/udp)

TCP dual-registration

2083/tcp is also radsec (Secure Radius Service) for RADIUS/TLS, assignee [IESG], contact [IETF_Chair], registration 2005-05, reference [RFC6614] [Confirmed] — IANA registry

Analyst note

the heavily-scanned cPanel SSL control panel on port 2083 is TCP, not UDP — do not conflate it with the UDP RADIUS/DTLS assignment. A responsive 2083/udp on the public Internet is unexpected and worth investigating.