2083

Port 2083/tcp is registered with IANA as radsec with the description "Secure Radius Service," assignee [IESG], contact [IETF_Chair], registration date 2005-05, and reference RFC 6614 (it is dual-registered, with 2083/udp also carrying the radsec name but referencing RFC 7360 for RADIUS-over-DTLS). RFC 6614 (May 2012) defines RADIUS over TLS, wrapping the entire RADIUS payload in a TLS stream over TCP/2083 so that the legacy plaintext-with-MD5 transport is replaced by X.509 certificate-based mutual authentication; the RADIUS shared secret is fixed to the literal string "radsec" because TLS subsumes its integrity role. The IANA registry itself notes that TCP/2083 was assigned for an earlier "RadSec" implementation (Open Systems Consultants' Radiator) before the RFC issued, and RFC 6614 Appendix A documents that compatibility. The primary real-world deployment is roaming federation infrastructure such as eduroam. Separately and unofficially, the same port is the long-standing cPanel & WHM HTTPS interface — administrators reach the hosting control panel at https://hostname:2083 — and this vendor convention, not the RadSec role, is what drives nearly all of the port's internet scanning exposure. That exposure is significant: the Brutus botnet (documented from March 2024, later tied by EclecticIQ to a Black Basta ransomware affiliate) targets cPanel ports 2082/2083, and CVE-2026-41940 (April 2026, critical) was an unauthenticated cPanel/WHM authentication bypass exploited in the wild for roughly 64 days before patching, with Rapid7 estimating ~1.5 million exposed instances. For RADIUS deployments the port is comparatively low-exposure because mutual TLS makes unauthenticated access structurally hard; for cPanel it is a routine credential-stuffing and brute-force target that should be IP-restricted or placed behind a VPN.

IANA assignment

radsec — "Secure Radius Service"; reference RFC 6614; assignee [IESG], contact [IETF_Chair]; registration date 2005-05; dual-registered 2083/tcp + 2083/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

Dual registration

2083/udp also radsec (Secure Radius Service), assignee [IESG], contact [IETF_Chair], registration 2005-05, modification 2014-07-14, reference RFC 7360 (RADIUS over DTLS) [Confirmed] — IANA registry CSV

Assignment note

TCP/2083 was previously assigned for an early "RadSec" implementation prior to the RFC; that implementation can be configured to be RFC-6614 compatible (see RFC 6614 Appendix A) [Confirmed] — IANA registry CSV; RFC 6614 App. A

Related ports

2082/tcp (cPanel HTTP), 2087/tcp (WHM HTTPS), 2095/2096 (webmail); RADIUS auth 1812/udp; legacy RadSec/RADIUS context

Primary use

RadSec — RADIUS over TLS per RFC 6614 (May 2012); RADIUS payload carried in a TLS stream with X.509 mutual auth; default destination TCP/2083; used in roaming federations such as eduroam

Other/unofficial uses

de-facto cPanel & WHM HTTPS interface (https://hostname:2083) by long-standing vendor convention — no IANA/RFC reference exists for this binding

Common software

RadSec/RADIUS-over-TLS network access servers, RADIUS proxies, eduroam federation infrastructure, Radiator (earliest known implementation); cPanel context: cPanel & WHM web hosting control panel

Security implications

scanning exposure is driven by the cPanel binding, not RadSec. Brutus botnet (from March 2024) targets cPanel 2082/2083, linked by EclecticIQ to a Black Basta RaaS affiliate (March 2025). CVE-2026-41940 (April 2026, critical) — unauthenticated cPanel/WHM auth bypass via session-cookie/header manipulation, all versions after v11.40, entry ports 2083/2087/2095/2096; exploited in the wild ~Feb 23 2026, patched Apr 28 2026 (~64-day window). Rapid7: ~1.5M exposed cPanel instances; Shadowserver: ~44,000 scanning/exploitation IPs post-disclosure. RadSec itself is low-exposure due to mutual TLS

Typically seen on

cPanel-managed web hosting servers (HTTPS panel); RADIUS/eduroam federation gateways

Analyst note

An open 2083/tcp is far more often a cPanel HTTPS panel than a RadSec endpoint; treat exposed cPanel logins as brute-force/credential-stuffing targets and restrict access. RadSec endpoints should present a TLS certificate and require client-cert mutual auth.

Port 2083/udp is registered with IANA as radsec with the description "Secure Radius Service," assignee [IESG], contact [IETF_Chair], a registration date of 2005-05, and reference [RFC7360]. It is the IANA-assigned default destination port for RADIUS over DTLS (Datagram Transport Layer Security), formally specified in RFC 7360 (September 2014). RADIUS/DTLS wraps standard RADIUS packets inside a DTLS session, adding encryption and mutual certificate-based authentication on top of UDP transport without altering the underlying RADIUS packet format — a direct response to legacy RADIUS/UDP's weak MD5-based obfuscation and lack of confidentiality. The port number was not new in 2014: IANA had already assigned 2083 (both TCP and UDP) for an early "RadSec" implementation of RADIUS over a secure transport before either standards-track RFC was issued, which the registry records explicitly in its assignment notes. RFC 7360 standardized the UDP/DTLS use of the port. Importantly, all RADIUS traffic — authentication, accounting, and dynamic authorization — shares port 2083; there are no separate sub-ports as there are in the legacy 1812/1813 split. The port is dual-registered on TCP as well: 2083/tcp is radsec for RADIUS over TLS, assignee [IESG], registration 2005-05, reference [RFC6614]. For an analyst the key distinction is that the high-exposure cPanel SSL hosting control panel that is widely scanned on port 2083 uses TCP, not UDP — the UDP assignment is exclusively RADIUS/DTLS. Legitimate 2083/udp traffic is an enterprise-internal or inter-site authentication protocol that should never face arbitrary Internet hosts; because it requires mutual X.509 certificate authentication, its attack surface is materially smaller than legacy RADIUS/UDP, and scanning interest in 2083/udp is comparatively low versus 1812/udp and 1645/udp.

IANA assignment

radsec — "Secure Radius Service"; reference [RFC7360]; assignee [IESG]; contact [IETF_Chair]; registration date 2005-05; modification date 2014-07-14 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

Assignment note

the port was already assigned for an early "RadSec" implementation of RADIUS over a secure transport before the RFC was issued; RFC 7360 standardized the UDP/DTLS use [Confirmed] — IANA registry assignment notes

Primary use

RADIUS over DTLS (RADIUS/DTLS) — encapsulates standard RADIUS packets inside a DTLS session for encryption and mutual certificate-based authentication (RFC 7360, September 2014)

Common software

Cisco IOS/IOS-XE, Juniper Junos, FreeRADIUS (DTLS-capable builds), Aruba/HPE infrastructure, enterprise NAC platforms (SecureW2, Portnox); deployed on NAS devices and RADIUS servers in 802.1X / enterprise Wi-Fi

Security implications

enterprise-internal protocol, should never be Internet-exposed; mutual X.509 certificate auth narrows attack surface versus legacy RADIUS/UDP (MD5-obfuscation, no encryption); scanning interest on 2083/udp is low relative to legacy RADIUS ports (1812/udp, 1645/udp)

TCP dual-registration

2083/tcp is also radsec (Secure Radius Service) for RADIUS/TLS, assignee [IESG], contact [IETF_Chair], registration 2005-05, reference [RFC6614] [Confirmed] — IANA registry

Analyst note

the heavily-scanned cPanel SSL control panel on port 2083 is TCP, not UDP — do not conflate it with the UDP RADIUS/DTLS assignment. A responsive 2083/udp on the public Internet is unexpected and worth investigating.