2375
Summary
- // if you see it open
- No authentication or encryption by default — any client that can reach the port gets root-equivalent control of the Docker host (container creation, host filesystem mount via bind-mount, arbitrary command execution). Docker's documentation warns remote access without TLS is not recommended. Active exploitation is documented: the Graboid cryptoworm (October 2019) compromised 2,000+ hosts to mine Monero, followed by Kinsing, TeamTNT, and WatchDog campaigns. CVE-2025-9074 formalizes the unauthenticated Docker Engine API exposure, demonstrating host filesystem access via bind-mount. Recommended posture: disable the TCP listener unless required; use 2376 with mutual TLS for remote access; block 2375 at the perimeter.
- // analyst note
- An open 2375 is a high-severity exposure — treat any internet-facing instance as a likely-compromised or imminently-targeted host; recommend disabling the listener or moving to 2376 with mTLS.
About port 2375/tcp.
Port 2375/tcp is registered with IANA as docker with the description "Docker REST API (plain text)," assignee [DOCKER] (contact Christopher Liljenstolpe), registered 2014-04-17, and a blank reference field; 2375/udp is Reserved with no assignee. The port carries the Docker Engine remote API — the full HTTP/REST control surface of the Docker daemon (dockerd): create/start/stop/delete containers, pull and push images, mount host volumes, exec commands, and manage networks. The plain-text name is literal — when a daemon is configured to listen here it does so without TLS and, by default, without authentication, so any client that can reach the port gets root-equivalent control of the host. Crucially, Docker does NOT open this port out of the box: a stock daemon listens only on the local Unix socket /var/run/docker.sock, and 2375 appears only when an operator explicitly enables a TCP listener. Port 2376 is the encrypted TLS counterpart and is the recommended choice for remote access. For an analyst, an exposed 2375 is a high-severity finding rather than a routine service: it has been the entry point for the Graboid cryptoworm (October 2019, 2,000+ hosts mining Monero) and follow-on Kinsing, TeamTNT, and WatchDog campaigns, and CVE-2025-9074 formalizes the unauthenticated-API host-filesystem-access scenario via bind-mount. Internet scans have repeatedly found thousands of exposed daemons (5,000+ in a 2019 survey with ~10–15% fully unauthenticated; 6,000+ in a 2023 Shodan survey), and port:2375 Docker remains a live Shodan query. The correct posture is to leave the TCP listener disabled unless required, use 2376 with mutual TLS when remote access is genuinely needed, and block 2375 unconditionally at the perimeter.
- IANA assignment
docker— "Docker REST API (plain text)"; reference (blank — no RFC cited in IANA registry); assignee [DOCKER], contact Christopher Liljenstolpe; registered 2014-04-17 [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry) + iana.org search- Range class
- registered (1024–49151)
- Dual registration
- 2375/tcp assigned to DOCKER; 2375/udp Reserved with no assignee [Confirmed] — IANA registry
- Prevalence/exposure
- 2019 scan 5,000+ exposed daemons, ~10–15% fully unauthenticated (1,400+ unsecured, 17,927 images, 15,229 volumes public); 2023 Shodan survey 6,000+ exposed hosts; live
port:2375 DockerShodan results [Threat-reported] — connected.app/ports/2375, secureflag knowledge base - Related ports
- 2376/tcp (Docker REST API over TLS); contrast the local Unix socket default
Primary use
Docker Engine remote API (REST/HTTP, plain-text, unencrypted). dockerd listens here only when explicitly configured for TCP; full container and host control. Default daemon listens only on the local Unix socket; 2376 is the TLS counterpart
Common software
Docker Engine / dockerd (primary); Docker CLI; Portainer; Jenkins Docker plugin (DOCKER_HOST=tcp://host:2375); Docker Desktop legacy localhost interop
Security implications
no auth or encryption by default → root-equivalent host takeover for any reachable client; Docker docs warn remote access without TLS is not recommended. Active exploitation: Graboid worm (Oct 2019, 2,000+ hosts), Kinsing/TeamTNT/WatchDog campaigns; CVE-2025-9074 (unauthenticated Docker Engine API → host filesystem via bind-mount)
Typically seen on
misconfigured Docker hosts, CI/CD build nodes, exposed cloud instances; should not be internet-facing
- Analyst note
- An open 2375 is a high-severity exposure — treat any internet-facing instance as a likely-compromised or imminently-targeted host; recommend disabling the listener or moving to 2376 with mTLS.
About port 2375/udp.
Port 2375/udp appears in the IANA Service Name and Transport Protocol Port Number Registry with the status "Reserved" — it carries no service name, no assignee, no contact, no registration date, no modification date, and a blank reference field. It is explicitly registered as Reserved rather than left unassigned, and the reservation rides alongside the well-known TCP sibling: 2375/tcp is assigned the service name docker (Docker REST API, plain text) to [DOCKER], contact Christopher Liljenstolpe, registered 2014-04-17. In practice 2375/udp has no defined application protocol and is not used by Docker or any widely deployed software; the operative use of port 2375 is entirely TCP, where the Docker Engine daemon (dockerd) exposes its unauthenticated, plain-text remote REST API when started with -H tcp://0.0.0.0:2375. The encrypted equivalent runs on 2376/tcp with TLS. For an analyst the practical bottom line is that nothing legitimately listens on 2375/udp, so the security weight of "port 2375" lives on the TCP side: an exposed plain-text Docker daemon grants root-equivalent control of the host, and campaigns such as TeamTNT / Spinning YARN (active through 2023–2024) routinely scan Shodan for open 2375/tcp endpoints to deploy cryptomining containers and DDoS bots. No scanning campaign specifically targeting 2375/udp has been documented, consistent with the UDP port being Reserved with no active service. The blank IANA reference is recorded as-is — no RFC was cited for this reservation.
- IANA assignment
- Reserved — no service name, no assignee, no contact, no registration/modification date, reference field blank for 2375/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 4564)
- Range class
- registered (1024–49151)
- Related ports
- 2376/tcp (Docker TLS), 2377/tcp (Docker Swarm), 2378–2380 (Docker cluster range)
Primary use
none — 2375/udp is Reserved with no defined application protocol; all real use of port 2375 is TCP-side
Common software
none on UDP; on 2375/tcp, Docker Engine daemon (dockerd) with -H tcp://0.0.0.0:2375 for un-TLS'd remote API; TLS variant is 2376/tcp
Security implications (TCP-side)
unauthenticated Docker daemon exposure grants root-equivalent host control; TeamTNT / Spinning YARN cryptomining and DDoS campaigns scan Shodan for open 2375/tcp (active through 2023–2024); cloud posture tools (Orca, stream.security) flag open inbound 2375/tcp as critical misconfiguration [Threat-reported] — https://isc.sans.edu/data/port/2375; https://securitylabs.datadoghq.com/articles/attackers-deploying-new-tactics-in-campaign-targeting-exposed-docker-apis/
Typically seen on
nothing legitimate on UDP; any responsive 2375/udp is anomalous
- TCP counterpart
- 2375/tcp =
docker, Docker REST API (plain text), assignee [DOCKER], contact Christopher Liljenstolpe, registered 2014-04-17 [Confirmed] — IANA registry (the IANA Service Name and Transport Protocol Port Number Registry line 4563) - UDP-specific exposure
- no documented scanning campaigns target 2375/udp; SANS ISC port-2375 data documents TCP activity only [Likely] — https://isc.sans.edu/data/port/2375
- Analyst note
- Treat the port-2375 risk as a TCP Docker-daemon exposure problem; 2375/udp itself carries no service and no known direct risk. Mitigate by binding
dockerdto a Unix socket or localhost, using TLS on 2376/tcp, and firewalling 2375/tcp.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| docker | TCP | docker.com | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.