Port reference
Port 16992 (TCP) – Intel AMT / ME
Intel Active Management Technology web/SOAP interface for out-of-band remote management below the operating system.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on Intel vPro systems with AMT provisioned. Often unmanaged or unprovisioned, leaving the management engine reachable on the network.
What is port 16992 used for?
Port 16992 is the web interface for Intel Active Management Technology (AMT), part of the Management Engine on Intel vPro business PCs and laptops. IT departments use it for out-of-band remote management — powering machines on or off, accessing a remote keyboard/screen (KVM), and redirecting boot media — even when the operating system is down. The encrypted version runs on port 16993.
When would you open it?
You only need this port if your organization actively uses Intel AMT to manage vPro computers remotely. In that case access stays inside the corporate network, restricted to the IT management stations that need it. Home users and most businesses never need it open.
Is it safe to open?
AMT runs beneath the operating system, so an exposed interface can mean full control of the machine; keep it on an isolated management network and never on the public internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :16992
nmap -p 16992 <target>netstat -ano | findstr :16992
Test-NetConnection <host> -Port 16992lsof -i :16992
nmap -p 16992 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 16992 to your device's local IP, internal port 16992, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 16992/tcpsudo firewall-cmd --permanent --add-port=16992/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 16992 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 16992" -Direction Inbound -Protocol TCP -LocalPort 16992 -Action AllowSecurity & risks
Common attacks
- CVE-2017-5689 authentication bypass using an empty password digest
- Full out-of-band takeover below the OS (power, KVM, boot media)
- Scanning for exposed AMT interfaces on 16992/16993
- Persisting in the management engine beneath the operating system
Hardening
- Unprovision AMT/ME where it is not actively used
- Apply Intel ME firmware updates that fix CVE-2017-5689
- Never expose 16992/16993 to the internet — isolate management VLANs
- Require strong AMT admin passwords and enable TLS (16993)
- Restrict access by IP allowlist to known management stations
How to block this port
sudo ufw deny 16992/tcpsudo firewall-cmd --permanent --remove-port=16992/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 16992 -j DROPNew-NetFirewallRule -DisplayName "Block 16992" -Direction Inbound -Protocol TCP -LocalPort 16992 -Action Blocknmap snippet
nmap -p16992 --script http-title,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What makes CVE-2017-5689 so serious?
- It lets an attacker authenticate to Intel AMT by sending an empty password digest, bypassing auth entirely. AMT runs below the OS, so a successful bypass grants full control regardless of the installed operating system.
- What is the difference between 16992 and 16993?
- 16992 is the plaintext HTTP interface to Intel AMT; 16993 is the TLS-encrypted equivalent. Both expose the same out-of-band management surface and should be locked down.