Port 5988WBEM HTTP

WBEM CIM-XML management traffic over unencrypted HTTP, typically used to query and manage systems through a CIM server.

transport: tcp · udp
in transit: cleartext
assignment: official
risk: 7/10
lookups: 0

also known as CIM-XML, WBEM CIM-XML

Technical Details

what runs on :5988

WBEM HTTP transports DMTF CIM-XML operations in HTTP request and response bodies, normally using TCP; the IANA assignment also lists UDP, although conventional HTTP WBEM deployments use TCP. A client establishes an HTTP session, sends XML-encoded CIM operations, and receives XML responses, with message framing and connection behavior provided by HTTP. Authentication and HTTP version details depend on the CIM server implementation. Port 5988 is the conventional cleartext counterpart to WBEM HTTPS on port 5989.

Security Information

exposure of :5988

risk score

7/ 10risk

treat as sensitive. widely scanned and regularly exploited when reachable — restrict it to known sources.

network services averages 3.2 across 852 ports — this one sits 3.8 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Traffic on port 5988 is not encrypted by default, so credentials and management data may be exposed to network observers unless protected by another control. A reachable CIM server can disclose detailed host, hardware, software, and configuration information and may permit authenticated management actions; it should generally be restricted to trusted management networks or replaced with port 5989/TLS.

Record

iana registry entry

port: :5988
service: WBEM HTTP
transport: TCPUDP
encryption: cleartext
assignment: iana registered
risk: 7/10risk
category: Network Services System
usage: Port 5988 carries WBEM (Web-Based Enterprise Management) CIM-XML requests and responses between management clients and a CIM Object Manager. Engineers may encounter it on server-management platforms, hardware-management systems, and enterprise monitoring tools; HTTPS commonly uses port 5989 instead.
lookups: 0rank 994
added: 2026-08-30
updated: 2026-08-30
references: IANA service name registry — port 5988

Something wrong?

This record is maintained by the engineers who use port 5988. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-08-30.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 852 in network services →

the 8 most looked-up other ports in network services — 852 ports carry that label.

port	service	proto	category	risk	views
:9080	Groove RPC	TCPUDP	Web Services	caution	70.8k
:6543	Jetnet	UDP	Network Services	caution	65.3k
:5938	TeamViewer	TCPUDP	Remote Access	caution	65.0k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:3233	WhiskerControl Protocol	TCPUDP	Network Services	caution	61.9k
:3268	Microsoft Global Catalog (GC)	TCPUDP	Security	caution	54.6k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:3128	Tatsoft Default HTTP Proxy	TCP	Web Services	caution	46.8k

risk mix of the 8 listed

caution100%

0 of 8 encrypted

Port :5988WBEM HTTP

Technical Details

Security Information

Related Ports

Port 5988WBEM HTTP