5000
Summary
- // if you see it open
- Medium-high when internet-exposed. Internet-facing Synology DSM admin consoles have been targeted by RCE campaigns from the 2013-2014 smart.cgi wave (CVE-2013-6955; Metasploit/exploit-db 48514) through CVE-2024-10443 (Synology Photos/BeePhotos zero-click RCE, Nov 2024). NETGEAR R6700 routers exposed a UPnP authentication bypass on TCP 5000 (CVE-2020-10923). Inadvertently exposed developer HTTP servers and several legacy trojan families are also documented on this port. Local-network AirPlay conflicts are a nuisance, not a security risk. Guidance: block 5000/tcp at the perimeter, prefer Synology HTTPS on 5001, disable unneeded UPnP.
- // common applications
- FlaskASP.NET Core KestrelmacOS AirPlay
- // analyst note
- An open 5000/tcp is common and ambiguous — most often a dev server, a Synology NAS admin page, or an AirPlay Receiver. Treat internet-exposed instances (especially Synology DSM and stray dev servers) as worth blocking at the perimeter and verifying what is actually listening.
About port 5000/tcp.
Port 5000/tcp is registered with IANA under the service name commplex-main, but the registry row carries no description, assignee, contact, registration date, or reference — every metadata column is blank, and the same name is dual-registered on 5000/udp with identical (blank) fields. The commplex-main name is effectively vestigial: no RFC defines it and almost nothing in the wild uses it. What makes 5000/tcp matter for an analyst is the opposite of port 1's near-unique signature — it is one of the most overloaded ports on the modern internet. By default it backs developer HTTP servers (Flask's Python dev server until 2.3, ASP.NET Core, and the Docker Registry all bind here), Apple's AirPlay Receiver (every Mac running the service since macOS Monterey listens on TCP 5000, the well-documented cause of "address already in use" Flask conflicts on macOS — Flask 2.3+ moved its macOS default to 5001 for this reason), the Synology DiskStation Manager (DSM) HTTP admin web interface (HTTPS on 5001), legacy Windows UPnP/SSDP event notification, and a long tail of unofficial uses (VTun VPN, FlightGear multiplayer, 3CX, Heroku, AWS Elastic Beanstalk proxy, Ragnarok Online). On the threat side, 5000 draws steady scanning logged by the SANS Internet Storm Center: campaigns have targeted internet-exposed Synology DSM consoles (the 2013–2014 smart.cgi RCE wave, and fresh Synology Photos/BeePhotos CVEs through 2024), a NETGEAR R6700 UPnP authentication bypass, and several legacy trojan families. So an open 5000/tcp is usually a dev server, a NAS, or an AirPlay-capable Mac — but when internet-exposed it warrants a closer look at what is actually answering.
- IANA assignment
commplex-main— Description, Assignee, Contact, Registration Date, Modification Date, and Reference columns all blank in the registry; dual-registered 5000/tcp + 5000/udp under the same name [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cachedthe IANA Service Name and Transport Protocol Port Number Registrylines 9237–9238); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5000- Range class
- well-known (0–1023)? No — 5000 is in the registered/user range (1024–49151) [Confirmed]
- Prevalence
- persistent daily scanning logged by SANS ISC (hundreds of probes/day from diverse IPs); not in Shodan's default lightweight scan set, though exposed Synology/dev instances are indexed [Likely] — https://isc.sans.edu/port.html?port=5000
- Related ports
- 5001/tcp (Synology DSM HTTPS, Flask's newer macOS default); 7000/tcp (AirPlay control); 32400 and other media/NAS ports
Primary use
no single dominant protocol; in practice a default dev-server port (Flask Python dev server until 2.3, ASP.NET Core, Docker Registry)
Other/unofficial uses
Apple AirPlay Receiver (macOS Monterey 2021+); Synology DSM HTTP admin (HTTPS on 5001); legacy Windows UPnP/SSDP event notification; VTun VPN; FlightGear multiplayer; 3CX; Heroku; AWS Elastic Beanstalk proxy; Ragnarok Online servers [Confirmed] — https://dev.to/pheeria/flask-airplay-and-the-port-5000-6j5 ; https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers ; https://portrm.dev/guides/port-5000-in-use-mac/
Security implications
internet-exposed Synology DSM consoles targeted by RCE campaigns (2013–2014 smart.cgi, CVE-2013-6955; ongoing through CVE-2024-10443 Synology Photos/BeePhotos zero-click RCE, Nov 2024); NETGEAR R6700 UPnP auth-bypass CVE-2020-10923; inadvertently exposed dev HTTP servers; several legacy trojan families documented on this port [Confirmed/Threat-reported] — https://isc.sans.edu/diary/17763 ; https://www.helpnetsecurity.com/2024/11/04/cve-2024-10443/ ; https://github.com/advisories/GHSA-p845-8rw7-6wm9 ; https://www.exploit-db.com/exploits/48514
Typically seen on
developer machines (Flask/ASP.NET/Docker Registry); Synology NAS devices; AirPlay-capable Macs; otherwise a candidate for closer inspection when internet-facing
- macOS Flask conflict
- Flask 2.3+ changed its macOS dev default to 5001 to avoid the AirPlay Receiver collision on 5000 [Confirmed] — https://medium.com/@Shamimw/why-you-should-stop-using-port-5000-for-your-flask-app-on-mac-399eebd7f181 ; https://blog.yimingliu.com/2023/01/01/cannot-connect-to-flask-development-server-on-localhost-port-5000/
- Analyst note
- An open 5000/tcp is common and ambiguous — most often a dev server, a Synology NAS admin page, or an AirPlay Receiver. Treat internet-exposed instances (especially Synology DSM and stray dev servers) as worth blocking at the perimeter and verifying what is actually listening.
About port 5000/udp.
Port 5000/udp is registered with IANA under the service name commplex-main, with a blank description, blank reference, and no published assignee or registration date in the registry — the TCP counterpart (5000/tcp) carries the identical commplex-main name and is equally sparse. The commplex service name traces to the original RFC 1340 "Assigned Numbers" port listing (1992) but has no documented protocol behind it and is effectively never used by that name in practice. Because IANA provides no description and no RFC, the practical meaning of 5000/udp is defined by real-world software rather than the registry. In the wild, UDP/5000 is a secondary, lightly documented surface: Yahoo Voice Chat historically used UDP ports 5000–5009 for peer-to-peer voice; some UPnP-enabled routers and media devices listen or respond on or near UDP/5000 for local service discovery; and various custom APIs and media services informally mirror their TCP/5000 binding onto UDP. The bulk of well-known "port 5000" software — Flask's development server, Docker Registry, Apple AirPlay's control channel, Synology DSM management — is TCP-only, so the UDP side is the minor partner. For an analyst, UDP/5000 matters mostly as scan and abuse context: when a UPnP or media service is bound there it can serve as a reflection/amplification vector, and Internet-wide scanners frequently sweep UDP/5000 alongside the more heavily targeted TCP/5000 (Synology DSM and unauthenticated Docker-registry probing). Rapid7's 2013 UPnP research found tens of millions of UPnP-exposed hosts (centered on SSDP/1900 but spanning the broader Portable UPnP SDK surface), reinforcing that any UDP/5000 service should be confirmed and not exposed to the public Internet without reason.
- IANA assignment
commplex-main— description blank, reference blank, no assignee or registration date in the registry; dual-registered 5000/tcp + 5000/udp, both equally sparse [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 9238 (udp) / line 9237 (tcp); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5000- Service-name origin
commplexappears in the historical RFC 1340 "Assigned Numbers" port table (1992); no protocol description is published and the name is not used in practice [Likely] — https://datatracker.ietf.org/doc/html/rfc1340- Range class
- user/registered (1024–49151)
- IANA reference / RFC
- blank — no RFC cited in the registry for this entry [Confirmed] — IANA service-names registry (search 5000)
- Registration / modification date
- not published by IANA for this entry [Confirmed] — IANA service-names registry (search 5000)
- Related ports
- 5000/tcp (same
commplex-mainname); SSDP 1900/udp (UPnP discovery); the 5001–5009 voice range
Primary use
no IANA-described use; in practice UDP/5000 is a secondary surface for UPnP/media-device service discovery and legacy peer-to-peer voice [Likely] — https://isc.sans.edu/port.html?port=5000, https://www.pentestpad.com/port-exploit/port-5000-upnp-docker-registry-custom-apis
Common software
Yahoo Voice/Messenger (UDP 5000–5009, legacy P2P voice); UPnP-enabled routers and media devices (UDP discovery on/near 5000); some Synology NAS configs (management mainly TCP/5000, UDP may open alongside); most famous 5000-port software (Flask, Docker Registry, AirPlay) is TCP-only
Security implications
UDP/5000-bound UPnP or media services can be abused for reflection/amplification DDoS; scanners sweep UDP/5000 alongside heavily targeted TCP/5000 (Synology DSM RCE, unauthenticated Docker registries); SANS ISC records ongoing port-5000 scan activity not always split by protocol; Rapid7's 2013 UPnP study found tens of millions of exposed hosts across the Portable UPnP SDK surface (centered on SSDP/1900) [Likely/Threat-reported] — https://isc.sans.edu/port.html?port=5000, https://www.pentestpad.com/port-exploit/port-5000-upnp-docker-registry-custom-apis, https://isc.sans.edu/diary/17771
Typically seen on
UPnP-enabled consumer routers/media devices; hosts also running a TCP/5000 service; legacy Yahoo voice clients
- Analyst note
- IANA gives UDP/5000 no described use, so verify what is actually listening; treat an exposed UDP/5000 as a possible UPnP/amplification surface and confirm before trusting it.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| upnp | UDP | also complex-main | 0.89% |
| upnp | TCP | commplex-main | 0.64% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.