TR-069
What is TR-069?
TR-069, also called CWMP (CPE WAN Management Protocol), is a standard ISPs use to remotely configure and update customer routers and modems, typically on port 7547. Reachable from the public internet instead of just the ISP's own network, a misconfigured TR-069 service has caused real router-compromise incidents, which is exactly what AdminKit's port check tool can help confirm.
By AdminKit team, Netbase JSC · Updated
TR-069, also called CWMP (CPE WAN Management Protocol), is a standard, published by the Broadband Forum as Technical Report TR-069, that ISPs use to remotely configure, update firmware on, and diagnose customer-premises equipment like routers and modems, typically listening on port 7547. It’s legitimate and widely deployed infrastructure, not inherently a vulnerability — but a misconfigured or outdated TR-069 implementation reachable from the public internet, rather than restricted to the ISP’s own management network, has been the root cause of real, large-scale router-compromise incidents: a Mirai botnet variant knocked roughly 900,000 Deutsche Telekom routers offline in November 2016 by exploiting a flaw in how they handled a TR-069-related command, an incident later documented in the USENIX Security 2017 Mirai study. The broader Mirai family that incident belongs to mostly spread by scanning for devices still using Telnet’s default factory credentials, with this TR-069 command flaw as a second way in. Whether a device’s TR-069 port is reachable only from the ISP’s network or from the broader internet is the key distinction for assessing risk — AdminKit’s guide on checking whether port 7547 is exposed walks through confirming that directly, and AdminKit’s port check tool runs the check itself.
TR-069 is part of AdminKit’s machine protocols cluster; the full AdminKit glossary lists other related terms.
Frequently asked questions
Is TR-069 itself a security vulnerability?
No -- TR-069 (CWMP) is legitimate ISP infrastructure for remote device management, not inherently a vulnerability. The risk comes from a misconfigured or outdated implementation reachable from the public internet instead of being restricted to the ISP's own management network.
What port does TR-069 use?
TR-069 typically listens on port 7547.
Did TR-069 cause a real botnet attack?
Yes -- a Mirai botnet variant exploited a flaw in how routers handled a TR-069-related command to knock roughly 900,000 Deutsche Telekom routers offline in November 2016, an incident documented in the USENIX Security 2017 Mirai study.
How do I check if my router's TR-069 port is exposed?
Check whether port 7547 responds to a connection from outside your network rather than only from your ISP's management network -- AdminKit's guide on checking port 7547 walks through confirming that directly.