TR-069
TR-069, also called CWMP (CPE WAN Management Protocol), is a standard ISPs use to remotely configure, update firmware on, and diagnose customer-premises equipment like routers and modems, typically listening on port 7547. It's legitimate and widely deployed infrastructure, not inherently a vulnerability -- but a misconfigured or outdated TR-069 implementation reachable from the public internet, rather than restricted to the ISP's own management network, has been the root cause of real, large-scale router-compromise incidents, including Mirai-related attacks in 2016 that exploited exposed TR-069 services to install botnet malware at scale. Whether a device's TR-069 port is reachable only from the ISP's network or from the broader internet is the key distinction for assessing risk.
By AdminKit team, Netbase JSC · Updated