Skip to content
ProtocolPorts

Port reference

Port 10000 (TCP) – Webmin

Default web port for Webmin, the browser-based Unix/Linux system administration panel.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
Critical

Actively exploited and high-impact — keep it off the public internet.

Default state

Open on servers running Webmin, often exposed to the internet for remote administration.

What is port 10000 used for?

Port 10000 is the default web port for Webmin, a popular browser-based control panel for administering Unix and Linux servers — managing users, packages, services, firewall rules, cron jobs, and more. You reach it at https://host:10000/. The related Usermin and Virtualmin tools share the same Webmin base. The port number is also occasionally used by other services such as some backup and NDMP tools, but Webmin is the usual occupant.

When would you open it?

Open or forward 10000 only if you run Webmin and need to reach its admin interface remotely. Because it effectively gives root-level control of the server, the safest approach is to keep it off the open internet and reach it through a VPN or bastion host, allowing only specific trusted IP addresses.

Is it safe to open?

Webmin is a root-level admin panel and a constant target for brute-force and exploits, so an exposed 10000 can mean full server takeover. Keep it behind a VPN, enforce strong credentials and MFA, and stay patched. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :10000
nmap -p 10000 <target>
Windows
netstat -ano | findstr :10000
Test-NetConnection <host> -Port 10000
macOS
lsof -i :10000
nmap -p 10000 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 10000 to your device's local IP, internal port 10000, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 10000/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=10000/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 10000 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 10000" -Direction Inbound -Protocol TCP -LocalPort 10000 -Action Allow

Security & risks

Common attacks

  • Pre-auth remote code execution via the CVE-2019-15107 password_change backdoor
  • Credential brute force and password spraying against the login
  • Exploiting other Webmin RCE/auth bugs to gain root
  • Information disclosure and abuse of admin functions once logged in

CVE-2019-15107

Hardening

  • Update Webmin to a fixed release; the 2019 backdoor affected specific versions
  • Never expose 10000 to the internet — restrict to VPN/bastion and allowlisted IPs
  • Disable the password-change feature unless required
  • Enforce strong credentials, MFA, and rate limiting/lockout
  • Serve only over HTTPS and keep Webmin patched

How to block this port

Linux (ufw)
sudo ufw deny 10000/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=10000/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 10000 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 10000" -Direction Inbound -Protocol TCP -LocalPort 10000 -Action Block

nmap snippet

nmap -p10000 --script http-title,http-headers,http-webmin-info <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 20000Port 22Port 443Port 8080

Frequently asked questions

What is CVE-2019-15107 in Webmin?
A pre-authentication remote code execution backdoor introduced into certain Webmin builds via the password_change.cgi feature. An unauthenticated attacker could run commands as root on port 10000. Update to a fixed version.
Is it safe to expose Webmin on port 10000 to the internet?
No. Webmin is a root-level admin panel and a frequent exploit and brute-force target. Restrict it to a VPN or bastion, allowlist source IPs, enforce MFA, and keep it patched.

Related guides