540

Port 540/tcp is registered with IANA as uucp with the description "uucpd" (the same service name and description are registered on 540/udp) and blank assignee, contact, and reference fields. It carries UUCP (Unix-to-Unix Copy) over TCP for store-and-forward file transfer, remote command execution, and mail and news exchange between Unix systems. The uucpd / in.uucpd daemon lets the UUCP transfer program uucico run over a TCP connection instead of a modem or serial line: inetd invokes in.uucpd on a connect to port 540 (the default UUCP service port), which prompts for a login name and password to authenticate uucico and then carries UUCP's 'g' protocol with handshaking, error detection, and flow control. In configuration terms, a tcp-conn entry in the UUCP Systems/sys file makes uucico connect to TCP 540 on the remote host. UUCP dates to Bell Labs in the 1970s and 1980s and underpinned early Usenet and email before being eclipsed by FTP and SMTP; related assignments include 117 (the UUCP path service) and 541 (uucp-rlogin). The IANA reference field is blank. Security-wise it is an ancient store-and-forward design: the login and password are prompted by uucpd (often via PAM), the mechanism is historically weak, and the modern footprint is minimal, so an open 540 essentially indicates a legacy Unix host still offering UUCP-over-TCP. For an analyst, an open 540 is almost always obsolete and should be disabled unless a deliberate store-and-forward link is in use.

IANA assignment

uucp — "uucpd" (540/tcp and 540/udp); reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 540/tcp + 540/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000138 (de-facto) [Well-established] — nmap-services file

Related ports

117 (UUCP path service), 541 (uucp-rlogin)

Primary use

UUCP store-and-forward transfer/command/mail-news exchange over TCP (uucpd)

Other/unofficial uses

none today [Well-established]

Security implications

ancient store-and-forward; login/password prompted by uucpd, historically weak; minimal modern footprint [Well-established]

Typically seen on

legacy Unix hosts (Solaris BNU/HoneyDanBer UUCP, IBM z/OS uucpd, older BSD/Linux)

Analyst note

An open 540 is a legacy UUCP host; almost always obsolete — disable unless a deliberate store-and-forward link is in use.

Port 540/udp is the paired UDP registration of uucp ("uucpd"), a service that is implemented over TCP: in.uucpd is invoked by inetd on a TCP connection, and no cited source documents a UDP listener. It is a legacy, largely obsolete service that should not be exposed to the public internet and is rare in real-world traffic today.

UUCP was designed for Unix-to-Unix file transfer, remote command execution, and store-and-forward mail/news relay, originally over dial-up serial links and later carried over TCP/IP so hosts without a modem connection could still exchange UUCP traffic. Port 540 is the IP-based socket for uucpd. The registry reserves the name on both transports, but the implementation is a TCP stream service — inetd invokes in.uucpd on a connection to TCP 540 — so the UDP row reserves the name rather than evidencing a UDP implementation.

IANA's registry lists 540/udp as uucp, description "uucpd," dual-registered alongside 540/tcp, with both the Assignee and Reference columns blank — there is no cited RFC backing this registration. No specific application, vendor product, or malware campaign was found tied to this port beyond generic historic uucpd implementations shipped with Unix systems; sources describe UUCP as largely obsolete on modern IP networks.

Exposure

UUCP predates modern authentication and transport security norms and is essentially unused in production today, so an open 540/udp is unusual and worth investigating rather than treated as routine.

Malware/CVE

No CVE or documented exploit specific to 540/udp was found as of an August 2026 search, and no verifiable malware or scanning-campaign detail was found tied to it.

Legacy risk

Historic UUCP implementations relied on weak, often plaintext authentication conventions typical of 1980s-era Unix tooling; a live listener likely reflects an old or misconfigured host rather than an intentional service.

IANA assignment

uucp — "uucpd"; Reference (blank); Assignee (blank); dual-registered 540/tcp + 540/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry uucp 540/udp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry uucp 540/udp

Prevalence

nmap-services open-frequency 540/udp = 0.000791 (~0.079%); 540/tcp = 0.000138 (~0.014%) [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

540/tcp (dual registration, same service); the small/legacy-services cluster generally

Primary use

the paired UDP registration of the uucp/uucpd name; UUCP itself — file transfer, remote command execution, and store-and-forward mail/news relay — is carried over TCP 540 by the inetd-invoked in.uucpd, and no source documents a UDP implementation

Other/unofficial uses

none documented beyond generic historic uucpd implementations bundled with Unix systems

Security implications

no CVE or documented exploit found specific to this port as of an August 2026 search; UUCP is legacy and rarely legitimately open today

Typically seen on

legacy/older Unix hosts running historic UUCP tooling, and then on the TCP side; otherwise an anomaly

Analyst note

An open 540/udp is uncommon on modern networks and is worth confirming as legitimate legacy UUCP infrastructure rather than assuming routine use.