Port 5989WBEM over HTTPS

WBEM CIM-XML management traffic carried over HTTPS, typically used by CIM servers and enterprise systems-management tools.

inSecurity System

transport: tcp · udp
in transit: encrypted
assignment: official
risk: 6/10
lookups: 0

also known as wbem-https, CIM-XML over HTTPS, CIMOM HTTPS

Technical Details

what runs on :5989

WBEM uses CIM-XML request and response messages transported as HTTP over TLS, normally on TCP port 5989. Clients establish a TLS session, authenticate according to the CIM server's configuration, and exchange HTTP messages containing CIM operations; message framing is therefore provided by HTTP rather than a custom transport framing layer. The registry also lists UDP, but normal WBEM-over-HTTPS deployments use TCP. The corresponding non-encrypted service is commonly associated with TCP port 5988.

Security Information

exposure of :5989

risk score

6/ 10risk

treat as sensitive. widely scanned and regularly exploited when reachable — restrict it to known sources.

security averages 3.6 across 246 ports — this one sits 2.4 above.

in transit

encrypted

payloads are protected on the wire

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

This is a management interface and should generally not be exposed directly to the public internet. An exposed endpoint can disclose inventory and configuration data and may permit authenticated management actions; attackers may also attempt credential attacks or exploit flaws in the particular CIM server, HTTP stack, or TLS configuration. Restrict access to trusted management networks or VPNs, require strong authentication, and keep the implementation patched.

Record

iana registry entry

port: :5989
service: WBEM over HTTPS
transport: TCPUDP
encryption: tls / encrypted
assignment: iana registered
risk: 6/10risk
category: Security System
usage: Port 5989 is commonly used by WBEM/CIM servers for remote hardware, operating-system, and infrastructure management over TLS. Engineers may encounter it with CIMOM implementations such as OpenPegasus and vendor systems-management agents; HTTP WBEM commonly uses port 5988.
lookups: 0rank 994
added: 2026-08-30
updated: 2026-08-30
references: IANA service name registry — port 5989

Something wrong?

This record is maintained by the engineers who use port 5989. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-08-30.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 246 in security →

the 8 most looked-up other ports in security — 246 ports carry that label.

port	service	proto	category	risk	views
:8881	Atlasz Secure Server	TCP	Web Services	caution	67.6k
:443	HTTPS	TCPtls	Web Services	caution	65.9k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:3268	Microsoft Global Catalog (GC)	TCPUDP	Security	caution	54.6k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:3128	Squid Proxy HTTP	TCP	Web Services	caution	45.8k
:8080	HTTP Alternate	TCPtls	Web Services	caution	44.9k
:7000	Vuze HTTPS Tracker	TCPtls	Security	caution	28.9k

risk mix of the 8 listed

caution100%

3 of 8 encrypted

Port :5989WBEM over HTTPS

Technical Details

Security Information

Related Ports

Port 5989WBEM over HTTPS