Port reference
Port 7547 (TCP) – TR-069 / CWMP
CWMP endpoint ISPs use to remotely provision and manage customer routers and CPE devices over the WAN.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on ISP-supplied routers/CPE so the provider's ACS can push config. Often reachable from the WAN side, making it a prime mass-exploitation target.
What is port 7547 used for?
Port 7547 runs TR-069 (also called CWMP), the protocol internet service providers use to remotely manage the routers and modems they supply. Through it, the provider's auto-configuration server can set up your connection, push firmware updates, and troubleshoot the device without a technician visit. It runs as a small management service on the router, usually reachable from the provider's side of the connection.
When would you open it?
For most people there is nothing to open: this port is meant for your ISP, not for you, and your router exposes it to the provider automatically. You would only touch it if you run your own ACS to manage devices, in which case you would restrict access to that server.
Is it safe to open?
Exposing 7547 to the open internet has led to large router takeovers, so it should only ever be reachable from your provider's management servers. See the security notes below.
How to check if this port is open
ss -tulpn | grep :7547
nmap -p 7547 <target>netstat -ano | findstr :7547
Test-NetConnection <host> -Port 7547lsof -i :7547
nmap -p 7547 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 7547 to your device's local IP, internal port 7547, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 7547/tcpsudo firewall-cmd --permanent --add-port=7547/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7547 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 7547" -Direction Inbound -Protocol TCP -LocalPort 7547 -Action AllowSecurity & risks
Common attacks
- Mass router takeover via the Mirai/Annie worm exploiting CWMP flaws
- Remote code execution through unauthenticated SOAP/RPC handling
- Hijacking provisioning to push malicious firmware or DNS settings
- Internet-wide scanning for vulnerable CPE to build botnets
Hardening
- Never expose 7547 to the public WAN; restrict to the ACS source IPs only
- Patch CPE firmware promptly and disable CWMP if unused
- Require authenticated, TLS-protected ACS connections
- Filter inbound 7547 at the ISP edge and on the device
- Monitor for unexpected provisioning requests and config changes
How to block this port
sudo ufw deny 7547/tcpsudo firewall-cmd --permanent --remove-port=7547/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7547 -j DROPNew-NetFirewallRule -DisplayName "Block 7547" -Direction Inbound -Protocol TCP -LocalPort 7547 -Action Blocknmap snippet
nmap -p7547 --script http-title,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 7547 used for?
- It runs TR-069 (CWMP), the protocol ISPs use to remotely configure and manage home routers and CPE via an auto-configuration server (ACS). It is typically reachable from the WAN.
- Why is port 7547 dangerous?
- CWMP flaws on exposed routers enabled worms like Mirai/Annie to take over millions of devices. If 7547 is open to the internet and the firmware is vulnerable, remote code execution and botnet enrollment are possible.