CyberHunter
Local dataset, no network
// IoT & industrial (ICS)

Port 502: Modbus TCP

Industrial control protocol for PLCs. It has no authentication.

mbapModbus
502

How Modbus TCP works

IoT & industrial (ICS)
controllerPLCWRITE coil 1no authentication controllerPLCWRITE coil 1no authentication

A controller sends commands to an industrial device on port 502, which acts on the physical process. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
10/10 critical if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
IoT & industrial (ICS)
01 Security

Is port 502 dangerous?

Common attacks and weaknesses

  • Anyone reaching the port can read and write PLC registers and change physical processes.

How to secure it

  • Never expose to the Internet; isolate OT networks and use protocol-aware firewalls.
02 Registry

IANA registry entries for port 502

ServicePortTransportDescriptionReferenceUpdated
mbap 502 TCP, UDP Modbus Application Protocol - 2014-06-10

// source: IANA service name and port number registry

03 Check it

Which program uses port 502, and is it reachable?

Linux

sudo ss -ltnup 'sport = :502'      # process listening on 502
sudo lsof -nP -i :502

macOS

sudo lsof -nP -i :502

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 502 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 502
netstat -ano | findstr :502

From another machine

nmap -p 502 -sV <host>
sudo nmap -sU -p 502 <host>
nc -zv <host> 502

Block it in the firewall

sudo ufw deny 502/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 502" -Direction Inbound -LocalPort 502 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 502 used for?

Industrial control protocol for PLCs. It has no authentication.

Is port 502 TCP or UDP?

Port 502 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 502?

It is rated 10/10 (critical) when exposed to the Internet. Anyone reaching the port can read and write PLC registers and change physical processes. Never expose to the Internet; isolate OT networks and use protocol-aware firewalls.

How do I check if port 502 is open?

On Linux run "ss -ltnup 'sport = :502'", on macOS "lsof -nP -i :502", and on Windows "netstat -ano | findstr :502" to see the local process. From another machine, "nmap -p 502 <host>" shows whether it is reachable.

05 Related
:1883 MQTT tcp · udp · high risk :8883 MQTT over TLS tcp · udp · moderate risk :102 Siemens S7 (ISO-TSAP) tcp · udp · critical risk :47808 BACnet udp · tcp · critical risk :20000 DNP3 tcp · udp · sctp · critical risk :44818 EtherNet/IP tcp · udp · critical risk :802 Modbus Application Protocol Secure tcp · udp :2221 EtherNet/IP over TLS tcp · udp

Latest vulnerability news

All news