830

Port 830 is registered with IANA as netconf-ssh with the description "NETCONF over SSH," blank assignee and contact, and a reference of [RFC6242] on both the TCP and UDP rows (verified against the live registry CSV, Last Updated 2026-05-29) — the registry cites RFC 6242, which obsoleted the earlier RFC 4742, not RFC 4742. It carries NETCONF, the Network Configuration Protocol (RFC 6241), over SSH (RFC 6242) — the standardized, mandatory-to-implement transport for installing, manipulating, and deleting network-device configuration, using YANG data models, an RPC paradigm, and XML payloads, running as the "netconf" SSH subsystem on TCP 830. It is the network-automation and configuration-management plane that complements or competes with RESTCONF and gNMI. In operation, a client opens an SSH2 connection to TCP 830 and invokes the netconf subsystem; RFC 6242 mandates that servers default to offering the netconf subsystem only on IANA port 830, so that firewalls can identify and filter it, and server and client then exchange hello capability documents. Framing uses the end-of-message marker ]]>]]> for base:1.0 (the RFC 4742 legacy framing, which is vulnerable to injection if that sequence appears in data) and chunked framing for base:1.1 (robust and injection-safe). The IANA reference field is [RFC6242]. Security-wise NETCONF grants complete device configuration control by design — modifying routing tables, disabling interfaces, changing firewall and ACL rules, or fully reconfiguring a device — so an exposed 830 is a critical management-plane exposure that means full router or switch takeover if credentials are compromised; it rides on SSH, so the channel is encrypted and authenticated, but the management plane should sit on isolated networks with role-based access control limiting permitted RPCs. Real-world exploitation is documented: in CVE-2026-20127 (a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller/Manager, exploited in the wild since at least 2023 by an actor Cisco Talos tracks as UAT-8616), the actor used NETCONF on port 830 and SSH to connect to and between Cisco SD-WAN appliances within the management plane, and CISA added it to the Known Exploited Vulnerabilities catalog and issued Emergency Directive 26-03 on 25 February 2026; a second CVSS-10.0 bypass, CVE-2026-20182 in the same controller, was demonstrated by Rapid7 Labs via SSH login to the NETCONF service on TCP 830 as the vmanage-admin user after injecting an SSH key, and a Synacktiv advisory found a command injection in NETCONF-over-SSH on TCP 830 in Cisco IOS XE before 17.2.1r leading to root. For an analyst, an open 830 is a network device's NETCONF management plane — critical if exposed — and it belongs only on isolated management networks; nmap-services lists 830/tcp at 0.000075.

IANA assignment

netconf-ssh — "NETCONF over SSH"; reference [RFC6242] (which obsoleted RFC 4742 — the registry cites 6242); assignee/contact blank; dual-registered 830/tcp + 830/udp (NETCONF runs over TCP; UDP is a legacy dual-assignment artifact)

[IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low raw scan frequency but near-ubiquitous on managed gear; nmap-services 830/tcp 0.000075 (de-facto) [Well-established] — nmap-services file

Related ports

443 (RESTCONF), 9339 (gNMI), 22 (SSH), 4334 (NETCONF Call Home SSH, RFC 8071), 4335 (Call Home TLS), 6513 (NETCONF over TLS, RFC 7589)

Primary use

standardized network-device configuration management (NETCONF over SSH, RFC 6241/6242)

Other/unofficial uses

the config-management plane alongside RESTCONF/gNMI [Well-established]

Security implications

complete device config control by design; exposed 830 = critical management-plane exposure / full device takeover if creds compromised; CVE-2026-20127 (Cisco SD-WAN auth bypass, CVSS 10.0, UAT-8616, NETCONF/830 used in-the-wild; CISA ED 26-03, 25 Feb 2026), CVE-2026-20182 (Rapid7, SSH→NETCONF/830 as vmanage-admin), Synacktiv IOS XE NETCONF/830 command-injection→root; isolate to management networks with RBAC

Typically seen on

routers/switches/appliances with NETCONF (Cisco IOS XE/XR/NX-OS, Juniper Junos, Arista EOS, Nokia SR OS/SR Linux, Huawei VRP); orchestration (Cisco NSO); automation (Ansible, SaltStack); Netopeer2

Analyst note

An open 830 is a network device's NETCONF management plane — critical if exposed; it belongs only on isolated management networks with RBAC.