873
Summary
- // if you see it open
- Two fronts. (1) Exposed modules: misconfigured anonymous rsync modules expose entire filesystems/backups for read (sometimes write); default is 'all users allowed' without auth users; traffic unencrypted. Rapid7 Labs (Dec 2018) found ~14,000 IPs with listable modules out of ~231,000 rsync servers, exposing 5.3M+ files. (2) Jan 2025 cluster (disclosed 2025-01-14, CERT/CC VU#952657, fixed rsync 3.4.0): CVE-2024-12084 (heap buffer overflow in daemon checksum-length handling, CVSS 9.8, RCE with anonymous read; introduced in 3.2.7), CVE-2024-12085 (stack info leak, defeats ASLR), CVE-2024-12086, CVE-2024-12087 (--inc-recursive path traversal), CVE-2024-12088 (--safe-links bypass), CVE-2024-12747 (symlink race). Shodan (BleepingComputer Jan 2025): >660,000 exposed, 306,517 on port 873.
- // common applications
- rsync
- // analyst note
- An open 873 is an rsync daemon; enumerate modules, check for anonymous access and the 2025 CVE cluster — a serious data-exposure risk.
About port 873/tcp.
Port 873/tcp is registered with IANA as rsync with the description "rsync" (lowercase), assignee and contact Andrew Tridgell — Paul Mackerras is not listed — and a blank reference field; rsync has no RFC defining its wire protocol (RFC 5781 only registers the rsync:// URI scheme, which defaults to port 873), and it is dual-registered on TCP and UDP in the well-known range (873 is below 1024). It is the native rsync daemon protocol: rsync (Tridgell and Mackerras, first released 19 June 1996 and formalized in Tridgell's 1999 PhD thesis) uses a delta-transfer algorithm that sends only the differences between files, and in daemon mode rsyncd listens on TCP 873 and exposes named "modules" (shares) that may be anonymous or authenticated via rsyncd.conf. rsync can also run over SSH (port 22), which does not use 873; with rsync 3.4.0 the protocol version moved to 32, which provides a way to check whether a remote server is patched. The IANA reference field is blank. Security-wise this is a higher-interest entry on two fronts. First, exposed modules are a chronic data-exposure vector: misconfigured anonymous rsync modules expose entire filesystems and backups to the internet for read (and sometimes write), the default is "all users allowed" when auth users is absent, and traffic is unencrypted — Rapid7 Labs (December 2018) found roughly 14,000 IPv4 addresses exposing listable modules out of ~231,000 rsync servers, exposing in excess of 5.3 million files. Second, the January 2025 six-CVE cluster (disclosed 14 January 2025 via CERT/CC VU#952657, fixed in rsync 3.4.0) is led by CVE-2024-12084, a heap buffer overflow in the daemon's checksum-length handling (CVSS 9.8) that lets anyone with anonymous read access execute code on the server, alongside CVE-2024-12085 (info leak that helps defeat ASLR), CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, and CVE-2024-12747; a Shodan scan reported by BleepingComputer found over 660,000 exposed rsync servers, of which 306,517 were on the default port 873. For an analyst, an open 873 is an rsync daemon: enumerate modules, check for anonymous access and the 2025 CVE cluster, and treat it as a serious data-exposure risk.
- IANA assignment
rsync— "rsync"; reference (blank — rsync has no wire-protocol RFC; RFC 5781 only registers the rsync:// URI scheme); assignee Andrew Tridgell; dual-registered 873/tcp + 873/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023; 873 < 1024)
- Prevalence
- commonly seen (distro mirrors, NAS, backup servers); in nmap's default top-1000 [Well-established] — nmap-services file
- Related ports
- 22 (SSH — rsync-over-SSH alternative), 8873 (rsync-over-SSH tunneling)
Primary use
native rsync daemon protocol — efficient delta-transfer file synchronization with named modules
Other/unofficial uses
rsync over SSH uses port 22 (NOT 873); 8873 for rsync-over-SSH tunneling [Well-established]
Security implications
exposed anonymous modules leak entire filesystems/backups (Rapid7 Dec 2018: ~14,000 IPs with listable modules, 5.3M+ files); Jan 2025 cluster — CVE-2024-12084 (heap overflow, CVSS 9.8, RCE with anonymous read) + CVE-2024-12085/12086/12087/12088/12747 (CERT/CC VU#952657, fixed rsync 3.4.0); Shodan >660,000 exposed (306,517 on port 873)
Typically seen on
Linux/Unix servers running rsyncd, NAS, distro mirrors, backup servers
- Analyst note
- An open 873 is an rsync daemon; enumerate modules, check for anonymous access and the 2025 CVE cluster — a serious data-exposure risk.
About port 873/udp.
Port 873/udp is registered with IANA as rsync with the description "rsync," assignee and contact both [Andrew_Tridgell] (Andrew Tridgell, the original author of rsync), and a blank reference field — it is dual-registered on TCP and UDP, with the matching 873/tcp entry sitting on the adjacent registry line. The IANA Reference column for this assignment is genuinely empty; no RFC defines rsync, so no RFC is cited. The practical reality of port 873 is that rsync runs over TCP exclusively. The UDP registration is a legacy paired assignment that mirrors the TCP entry — standard practice at the time the port was reserved — but no rsync implementation uses UDP transport, so 873/udp is effectively a placeholder that almost never carries traffic. All real-world deployment, scanning, exposure, and exploitation data for port 873 concerns TCP. rsync itself is a delta-transfer file synchronization tool: it sends only the differences between source and destination files to minimize bandwidth, and is widely used for automated backups, website and OS-mirror synchronization, CDN origin replication, and code deployment on Linux/Unix servers. For an analyst, the security signal lives entirely on 873/tcp: bare rsyncd daemon mode exposed to the internet without authentication is routinely targeted, hundreds of thousands of rsync servers are internet-exposed (scans in January 2025 counted from ~306,000 to ~850,000 depending on timing and filters), and a January 2025 CVE batch — most severely CVE-2024-12084 (CVSS 9.8, heap buffer overflow exploitable by an anonymous client on read-only modules, present since v3.2.7) — was fixed in rsync 3.4.0. A response on 873/udp specifically is anomalous and is not normal rsync behavior; the hardened posture is to tunnel rsync over SSH rather than expose rsyncd, restrict modules with IP allowlists, disable write access, and upgrade to rsync >= 3.4.0.
- IANA assignment
rsync— description "rsync"; reference (blank — no RFC cited in IANA registry); assignee and contact both[Andrew_Tridgell]; dual-registered 873/tcp + 873/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 1592; tcp on line 1591)- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- 873/tcp (the active rsync transport); 8873 (alternate/SSL rsync port seen in scans); contrast SSH (22) as the hardened transport
Primary use (in practice)
rsync delta-transfer file synchronization; runs over TCP only — the UDP entry is an unused paired registration
Common software
rsync daemon (rsyncd), originated by Andrew Tridgell; ubiquitous on Linux/Unix, web hosting, CDN origin sync, OS mirror networks, DevOps pipelines
Exposure / scanning
large internet exposure on TCP/873 — Jan 2025 scans counted ~850,036 (Rapid7/Shodan) vs ~306,517 on 873 + ~21,239 on 8873 (BleepingComputer); range reflects scan timing/filter differences; China a large share (~521,000 per one count)
Security implications
HIGH RISK when rsyncd is internet-exposed unauthenticated; Jan 2025 CVE batch fixed in rsync 3.4.0 — CVE-2024-12084 (CVSS 9.8, heap overflow, anonymous RCE on read-only modules, since v3.2.7) plus CVE-2024-12085/12086/12087/12088/12747; no in-the-wild exploitation documented as of Feb 2025 per Rapid7
- UDP in practice
- not used; no rsync implementation uses UDP transport, all usage/exposure/CVE data relates to TCP/873 [Likely] — IANA registry inspection + absence of any UDP rsync implementation in the literature
- Security posture
- tunnel rsync over SSH rather than running bare
rsyncdon 873; IP allowlists per module; disable write unless required; strong passwords; upgrade to rsync >= 3.4.0; firewall-block 873/tcp except to trusted hosts [Confirmed] — SecurityScorecard, HackTricks - Analyst note
- a response on 873/udp is anomalous — rsync uses TCP only, so investigate UDP/873 activity as a scan artifact, decoy, or unrelated service rather than legitimate rsync.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| rsync | TCP | Rsync server ( http://rsync.samba.org ) | 0.34% |
| rsync | UDP | — | 0.07% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.