Is port 5985 (WinRM HTTP) dangerous?

Port 5985 is classified as critical risk and should not be exposed to the public internet. It transmits data without encryption, making it vulnerable to eavesdropping and credential theft.

Should port 5985 be open on my firewall?

No, port 5985 should not be open to the public internet. Block it at the firewall and use encrypted alternatives such as SSH, SFTP, or HTTPS instead.

What transport protocol does port 5985 use?

Port 5985 (WinRM HTTP) uses the TCP transport protocol and falls under the Remote Access category.

:5985 (TCP)

WinRM HTTP

Critical Riesgo

TCP — Remote Access

On this page

Resumen del puerto

Número de puerto 5985

Nombre del servicio WinRM HTTP

Protocolo de transporte TCP

Categoría Remote Access

Riesgo de seguridad Critical

Rango de puertos Registrados (1024-49151)

Qué es el puerto 5985?

Port 5985 is used by Windows Remote Management (WinRM) for HTTP-based remote PowerShell and management connections. WinRM implements the WS-Management protocol for remote Windows administration and is used by tools like Ansible and PowerShell remoting. Exposure of this port allows remote command execution on Windows systems.

TCP Remote Access De uso común

Consideraciones de seguridad

El puerto 5985 (WinRM HTTP) está clasificado como riesgo crítico. Este puerto no debe exponerse a internet público. El servicio transmite datos sin cifrado, haciéndolo vulnerable a escuchas, robo de credenciales y ataques de intermediario.

Recomendación: Bloquea este puerto en el firewall. Utiliza alternativas cifradas (SSH, SFTP, HTTPS) en su lugar.

WinRM HTTP

Resumen del puerto

Qué es el puerto 5985?

Consideraciones de seguridad

Puertos relacionados — Remote Access

Términos relacionados