Port reference
Port 32764 (TCP) – SerComm Router Backdoor
A real OEM router backdoor on SerComm-built devices that exposes remote command execution and config dumping over port 32764.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Not a legitimate service. A listening 32764 on a home/SOHO router signals the SerComm OEM backdoor and should be closed immediately.
What is port 32764 used for?
Port 32764 has no legitimate purpose — it is the listener for a notorious backdoor discovered in many home and small-office routers built by SerComm and sold under brands like Linksys, Netgear, and Cisco. A service on this port accepts unauthenticated commands, letting anyone who can reach it read the router's configuration and passwords, run commands, or reset it to factory settings. It was publicized in 2014.
When would you open it?
You would not. No real feature uses port 32764, so it should never be opened or forwarded. If your router is listening on 32764, it likely has the vulnerable firmware — update it, or replace the router if no fix is available.
Is it safe to open?
No — an open 32764 means an attacker can take full control of your router and the network behind it, so block it and patch the firmware. See the security notes below.
How to check if this port is open
ss -tulpn | grep :32764
nmap -p 32764 <target>netstat -ano | findstr :32764
Test-NetConnection <host> -Port 32764lsof -i :32764
nmap -p 32764 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 32764 to your device's local IP, internal port 32764, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 32764/tcpsudo firewall-cmd --permanent --add-port=32764/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 32764 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 32764" -Direction Inbound -Protocol TCP -LocalPort 32764 -Action AllowSecurity & risks
Common attacks
- Remote command execution via the SerComm router backdoor
- Dumping of router configuration and credentials
- Resetting the device to factory state without authentication
- Mass scanning of SOHO routers for the exposed backdoor
Hardening
- Apply the vendor firmware update that removes the SerComm backdoor
- Never expose router management or 32764 to the WAN/internet
- Block inbound 32764 at the perimeter and on the device firewall
- Replace end-of-life routers that will never be patched
How to block this port
sudo ufw deny 32764/tcpsudo firewall-cmd --permanent --remove-port=32764/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 32764 -j DROPNew-NetFirewallRule -DisplayName "Block 32764" -Direction Inbound -Protocol TCP -LocalPort 32764 -Action Blocknmap snippet
nmap -p32764 -sV --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the port 32764 backdoor?
- It is a real OEM backdoor found in routers built by SerComm. A service listening on TCP 32764 accepts unauthenticated commands that can dump config, run commands, or factory-reset the device.
- How do I fix the 32764 backdoor?
- Install the vendor firmware update that removes the backdoor, never expose port 32764 or router management to the internet, and replace end-of-life devices that will never receive a patch.