541
Summary
- // typical exposure
- Restricted (trusted networks only) — FGFM is a legitimate FortiGate-to-FortiManager management protocol that should be limited to trusted management networks, VPN, or IP allowlists rather than left open on internet-facing WAN interfaces, given two reported CVSS 9.8 unauthenticated-RCE flaws in the service.
- // common applications
- Fortinet FortiGate (fgfmd)Fortinet FortiManager (fgfmsd) Traffic on this port is most often Fortinet's FGFM management protocol; FortiGate (fgfmd) and FortiManager (fgfmsd) have been reported using it for centralized configuration distribution, while the legacy uucp-rlogin IANA assignment is essentially never seen in practice.
- // analyst note
- A responsive 541/tcp on an internet-facing address most likely fingerprints a Fortinet device with FGFM management enabled; verify whether the
fgfmallowaccess setting is unintentionally exposed on a WAN interface before assuming benign use. - // if you see it open
- FGFM is a legitimate management channel that opens on a FortiGate interface when 'fgfm' is enabled in allowaccess settings. Administrators have reported it exposed on internet-facing WAN interfaces during external scans. Two reported CVSS 9.8 unauthenticated-RCE vulnerabilities target the service: CVE-2024-23113 (format-string flaw in FortiOS FGFM handling) and CVE-2024-47575 / 'FortiJump' (missing authentication in the FortiManager FGFM daemon). No malware/trojan association was found as of an August 2026 search.
About port 541/tcp.
Port 541/tcp is registered with IANA as uucp-rlogin, an obsolete Unix-to-Unix Copy (UUCP) remote-login variant, but on the modern internet an open 541/tcp is almost always Fortinet's FGFM management channel between a FortiGate and a FortiManager, and it should be restricted to trusted management networks rather than exposed to the public internet.
The IANA registry lists 541 as dual-registered on TCP and UDP for uucp-rlogin, assignee Stuart Lynne, with a blank Reference field and no registration or modification dates recorded. The service is a relic of pre-internet dial-up Unix networking and is essentially never encountered as its original protocol on live hosts today.
In current practice, 541/tcp is carried by Fortinet's FGFM protocol: FortiOS runs a fgfmd daemon and FortiManager runs fgfmsd, and the port opens automatically on a FortiGate interface when fgfm is included in the Administrative Access (allowaccess) settings, used for centralized configuration distribution and coordination with FortiGate Cloud Management.
Fortinet's own community support forum contains multiple threads from administrators who found 541 open during external scans of FortiGate WAN interfaces, typically because the fgfm allowaccess setting was left enabled on an internet-facing interface rather than restricted to a management segment. Two reported CVSS 9.8 vulnerabilities target the FGFM service when internet-reachable.
- Notable CVE
- CVE-2024-23113, a format-string flaw in FortiOS's FGFM handling reported as enabling unauthenticated remote code execution (northwave-cybersecurity.com threat-response page; pentestpad.com port reference).
- Notable CVE
- CVE-2024-47575 ("FortiJump"), a missing-authentication flaw in the FortiManager FGFM daemon reported as enabling unauthenticated remote code execution (northwave-cybersecurity.com; pentestpad.com).
- Fingerprinting
- An open 541 signals a Fortinet device using centralized management (FortiManager or FortiGate Cloud Management), which can help an attacker prioritize a target.
- Malware
- No malware/trojan association was found for this port as of an August 2026 search; the documented risk is unauthenticated RCE in the legitimate FGFM service when exposed, not malware abusing the port.
- IANA assignment
uucp-rlogin— description column reads the bare string "uucp-rlogin" (the name expands, informally, to UUCP remote login; that gloss is not the registry's wording); reference (blank); assignee Stuart Lynne; dual-registered 541/tcp + 541/udp[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry uucp-rlogin 541/tcp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry uucp-rlogin 541/tcp
- Prevalence
- nmap-services open-frequency 541/tcp = 0.000489 (~0.05%); 541/udp = 0.000807 (~0.08%) [Confirmed] — this site's own tooling
- Related ports
- 541/udp (dual registration); FortiGate admin HTTPS 8443 (contextual, not co-registered)
Primary use (legacy)
uucp-rlogin, a UUCP remote-login variant (the expansion is a gloss, not a registry string); RFC/reference blank in registry; rarely if ever deployed today
Primary use (modern, real-world)
Fortinet FGFM (FortiGate fgfmd to FortiManager fgfmsd) management protocol [Confirmed] — https://www.pentestpad.com/port-exploit/port-541-uucp-rlogin-fortigateuunet-pipe, https://community.fortinet.com/t5/FortiGate/Technical-Tip-Port-Scan-showing-port-541-open-on-FortiGate/ta-p/274749
Security implications
two CVSS 9.8 unauthenticated-RCE CVEs reported against the FGFM service when internet-reachable (CVE-2024-23113, CVE-2024-47575); no malware association found [Likely] — https://northwave-cybersecurity.com/threat-response-fortios-unauthenticated-remote-code-execution, https://www.pentestpad.com/port-exploit/port-541-uucp-rlogin-fortigateuunet-pipe
Typically seen on
FortiGate and FortiManager management segments; anomalous elsewhere [Likely] — https://community.fortinet.com/t5/Support-Forum/Port-Scan-showing-port-541-being-open-on-FortiGate-WAN-interface/m-p/317776
- Analyst note
- A responsive 541/tcp on an internet-facing address most likely fingerprints a Fortinet device with FGFM management enabled; verify whether the
fgfmallowaccess setting is unintentionally exposed on a WAN interface before assuming benign use.
About port 541/udp.
Port 541/udp is registered with IANA as uucp-rlogin; it is a legacy, pre-internet Unix service and has no legitimate reason to be reachable from the public internet today. A live UDP listener on 541 is best treated as anomalous rather than as an expected service.
IANA assigns 541 (both tcp and udp) to uucp-rlogin, assignee Stuart Lynne, with a blank Reference field — no RFC is cited in the registry. The name describes a Unix-to-Unix Copy (UUCP) variant that tunneled a remote-login (rlogin) session, a dial-up-era mechanism for reaching a shell on a remote Unix host without today's authentication or encryption.
That original service is essentially unused now. Community port-lookup and pentest reference pages instead describe modern TCP port 541 traffic as almost always Fortinet's FGFM (FortiGate-to-FortiManager) management protocol, served by fgfmd on FortiOS and fgfmsd on FortiManager. That association is documented specifically for the TCP side; no source found ties FGFM, or any other named application, to 541/udp, so the modern-usage picture for this UDP port specifically remains unclear beyond the original IANA entry.
Two unauthenticated remote-code-execution CVEs are documented against the FGFM service most associated with the related TCP port, and a port-lookup source separately reports the port has no notable malware-activity indicators. Neither finding is confirmed to extend to the UDP variant, but both are worth carrying as context for anyone who sees 541 open.
- Exposure
- No legitimate reason for 541/udp to face the public internet; treat any response as anomalous and worth investigating (uucp-rlogin — Confirmed registry entry, RFC-less; modern-usage evidence is TCP-side only).
- Notable CVE
- CVE-2024-47575 ("FortiJump," CVSS 9.8, FortiManager
fgfmsd, exploited since June 2024) and CVE-2024-23113 (FortiOSfgfmdformat-string flaw, CVSS 9.8) are both listed in CISA's Known Exploited Vulnerabilities catalog and associated with the FGFM protocol tied to TCP 541 — https://www.pentestpad.com/port-exploit/port-541-uucp-rlogin-fortigateuunet-pipe. - Malware association
- A port-lookup reference states the port "does not have notable malware activity indicators," a negative finding — https://www.auditmypc.com/tcp-port-541.asp.
- UDP-specific caveat
- Every modern-usage and CVE finding above is documented for TCP 541; no source distinguishes a separate exposure profile for 541/udp, so treat the FGFM/CVE context as background rather than a confirmed UDP finding.
- IANA assignment
uucp-rlogin; reference (blank — no RFC cited); assignee Stuart Lynne; dual-registered 541/tcp + 541/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry uucp-rlogin 541/udp- Range class
- well-known/system (0-1023) [Confirmed] — this site's own tooling (port 541)
- Prevalence
- nmap-services open-frequency for 541/udp = 0.000807 (~0.08%); 541/tcp = 0.000489 [Confirmed] — this site's own tooling (port 541)
- Related ports
- 541/tcp (dual registration, same service name); Fortinet FGFM ecosystem ports
Primary use
legacy Unix-to-Unix Copy (UUCP) remote-login tunnel; no RFC documents the protocol
Other/unofficial uses
on the TCP side, Fortinet FGFM (FortiGate-to-FortiManager) management channel is the modern de-facto use; no equivalent finding for UDP
Security implications
no confirmed CVE or malware association specific to 541/udp; the FGFM CVEs (CVE-2024-47575, CVE-2024-23113) and the "no notable malware activity" finding are documented for the TCP side [Likely] — https://www.pentestpad.com/port-exploit/port-541-uucp-rlogin-fortigateuunet-pipe, https://www.auditmypc.com/tcp-port-541.asp
Typically seen on
essentially no legitimate modern hosts by design; an open 541/udp is an anomaly worth investigating [Unknown — no UDP-specific sighting found]
- Analyst note
- Traffic on 541/udp has no confirmed modern legitimate driver; investigate as an anomaly rather than assuming a routine service, and note that the FGFM/CVE context documented for TCP 541 does not automatically apply here.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| uucp-rlogin | UDP | — | 0.08% |
| uucp-rlogin | TCP | — | 0.05% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.