5601

Port 5601/tcp carries a split identity that an analyst has to hold in mind at once. In the IANA Service Name and Transport Protocol Port Number Registry the port is assigned to esmagent ("Enterprise Security Agent"), assignee Kimberly Gibbs, dual-registered on both TCP and UDP, with the registration-date, modification-date, and Reference columns all blank — IANA cites no RFC. That registered name is essentially never what a responsive 5601 means in the wild. In practice 5601/tcp is the default bind port for Kibana, the browser-based front-end of the Elastic Stack (formerly the ELK Stack), where it serves a UI for searching, visualizing, and managing data held in Elasticsearch plus cluster monitoring and security configuration. This makes the port operationally interesting: a default Kibana install binds to localhost (127.0.0.1:5601), so internet exposure is usually the result of an administrator deliberately binding to 0.0.0.0 or fronting the instance with a permissive cloud security group. Because Kibana's authentication is inherited from Elasticsearch, an Elasticsearch cluster left without auth leaves Kibana wide open — any connecting client lands on an admin-grade dashboard. Shodan indexes the service heavily (the kibana search returns roughly ten thousand-plus results, and a 2019 Security Affairs report counted over 26,000 unprotected instances), and cloud-security benchmarks from Orca, VMware SecureState, and stream.security all flag unrestricted inbound 5601 as a misconfiguration. The history of remote code execution via CVE-2019-7609 (Timelion prototype pollution) is the reason an exposed, unpatched 5601 is treated as a high-priority finding rather than a curiosity.

IANA assignment

esmagent — "Enterprise Security Agent"; reference (blank — no RFC cited in IANA registry); assignee Kimberly Gibbs; dual-registered 5601/tcp + 5601/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 9930-9931)

Range class

registered (1024–49151)

IANA-to-real mismatch

Kibana's use of 5601 is a de-facto Elastic default, NOT an IANA assignment; the registered name is esmagent [Confirmed] — IANA registry + Orca Security

Related ports

9200/9300 (Elasticsearch REST/transport); 5044 (Logstash Beats input)

Primary use

Kibana — default web UI bind port for the Elastic Stack (search, visualization, management, monitoring of Elasticsearch data)

Exposure / scanning

actively indexed by Shodan (http.title:"Kibana" port:5601 is a known dork; ~10k+ kibana results); 2019 Security Affairs report counted 26,000+ unprotected instances, concentrated in US/China on AWS/Alibaba/Azure/GCP

Notable CVEs

CVE-2019-7609 (Kibana 3.0–5.6.14 / 6.0.0–6.6.0, Timelion prototype pollution → authenticated OS command execution; patched Feb 2019 in 5.6.15/6.6.1; public PoC Oct 2019, 4,200+ exposed vulnerable instances per BinaryEdge); CVE-2025-68385 (Kibana ~8.19/9.x, authenticated XSS via Vega bypass, CVSS 6.0, disclosed Dec 2025)

Typically seen on

Elastic Stack / ELK observability and SIEM deployments; default install binds to localhost, so a public 5601 reflects an explicit 0.0.0.0 bind or open cloud security group

Authentication behavior

Kibana auth is inherited from Elasticsearch; an unauthenticated Elasticsearch leaves Kibana unauthenticated with admin-level dashboard access [Confirmed] — Orca Security, stream.security

Security posture

cloud-security benchmarks treat unrestricted inbound 5601 as a misconfiguration; controls = restrict to trusted/VPN IPs, enable Elastic security (X-Pack/TLS + auth), stay on a supported version [Confirmed] — stream.security, Orca, VMware SecureState

Analyst note

A responsive 5601 almost always means Kibana, not esmagent. Check whether it is authenticated and patched — an open, unauthenticated, or unpatched Kibana is a serious exposure (potential data access and, on old versions, RCE).

Port 5601/udp is registered with IANA as esmagent, described as "Enterprise Security Agent," assignee Kimberly Gibbs, with blank Registration Date, Modification Date, and Reference columns — and it is dual-registered on TCP and UDP, the TCP counterpart carrying the identical service name, description, and assignee. The registration traces to Axent Technologies' OmniGuard/ESM (Enterprise Security Manager) product, where the ESM manager listens to receive status and data communications from deployed ESM agents across managed hosts. Axent was acquired by Symantec (later Broadcom), and the product continued as Symantec Enterprise Security Manager through the 6.x–10.x versions, making this a legacy but not strictly defunct assignment. The practical complication for an analyst is naming collision rather than the registration itself: TCP 5601 is the well-known default port for the Kibana (Elastic Stack) web UI, and that is where essentially all modern security interest in "5601" concentrates — SANS ISC tracks active scanning against TCP 5601, and CVE-2019-7609 (the Kibana Vega timelion RCE) has been exploited in the wild against internet-exposed Kibana. Crucially, Kibana uses TCP only, so that activity is unrelated to the UDP IANA registration. There are no CVEs or dedicated scanning campaigns documented specifically for 5601/udp (esmagent); legacy ESM agent deployments are unlikely to be internet-facing, so unexpected UDP 5601 traffic in a modern environment is uncommon and worth investigating rather than treating as routine. The IANA Reference field is blank — this is a user-port assignment, not an RFC-standardized protocol — and no registration or modification dates are recorded in the registry.

IANA assignment

esmagent — "Enterprise Security Agent"; reference (blank — no RFC cited in IANA registry); assignee Kimberly Gibbs; dual-registered 5601/tcp + 5601/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5601

Range class

registered/user (1024–49151)

Registration / modification dates

none recorded in the IANA registry (Registration Date and Modification Date columns blank) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

IANA reference

blank (user-port assignment, not RFC-standardized) [Confirmed]

Related ports

TCP 5601 (Kibana / Elastic Stack default UI); the esmagent TCP counterpart

Primary use

Axent Technologies OmniGuard/ESM (Enterprise Security Manager) agent-to-manager communication channel; later Symantec ESM (now Broadcom)

Common software

Axent OmniGuard/ESM; Symantec Enterprise Security Manager 6.x–10.x [Confirmed]. Note: TCP 5601 is also the default Kibana (Elastic Stack) web UI port — Kibana is TCP-only, so that usage is unrelated to this UDP registration

Security implications

no specific CVEs or scanning campaigns documented for 5601/udp (esmagent); legacy enterprise agent protocol with minimal modern internet exposure. Distinct context for TCP 5601 (Kibana): SANS ISC tracks active scanning, and CVE-2019-7609 (Kibana Vega RCE) is exploited in the wild against exposed Kibana — TCP only, not this UDP entry

Exposure/scanning

SANS ISC port-5601 attack data aggregates TCP+UDP and is dominated by Kibana (TCP) scanner activity; no dedicated UDP-specific esmagent campaigns found

Typically seen on

legacy Axent/Symantec ESM-managed hosts; UDP 5601 is uncommon in modern environments and warrants investigation if observed

Analyst note

Keep the UDP esmagent registration separate from the far more common Kibana TCP 5601 usage. Unexpected UDP 5601 is rare today and worth investigating; the headline 5601 security activity is Kibana-on-TCP, not esmagent.