Is port 7547 (TR-069) exposed beyond your ISP's management network?

What’s running on 7547, and why

TR-069 (Technical Report 069, the specification that defines CWMP — the CPE WAN Management Protocol) lets an ISP’s Auto-Configuration Server push firmware updates, change settings and diagnose problems on the router or modem they provided, without a technician visit. It’s a normal, widely deployed management tool — the question isn’t whether TR-069 exists, but whether port 7547 is reachable from anywhere beyond your ISP’s own management network.

The 2016 incident, briefly

In November 2016, a Mirai botnet variant scanned the public internet for devices listening on port 7547 and sent a crafted command exploiting a flaw in how certain router models handled a related TR-064 request. Deutsche Telekom’s own routers weren’t vulnerable to the underlying code-injection, but the volume of malicious scan traffic alone crashed roughly 900,000 of them over a single weekend — widely reported at the time and later documented in the USENIX Security 2017 Mirai study. In the aftermath, affected ISPs restricted public access to port 7547 and pushed firmware patches, which is now the standard configuration for a properly managed ISP router.

How to check your own exposure

AdminKit’s planned open ports check is designed to test whether port 7547 on your public IP responds from outside your ISP’s network. If you manage your own hardware rather than relying on an ISP-provided router, this is worth checking directly.

What to do if it’s reachable

On most ISP-provided routers, TR-069 access is configured by the ISP, not something you can toggle from the device’s own admin page — if port 7547 appears reachable from the broader internet rather than just your ISP’s management network, contact your ISP to ask whether access is properly restricted. If you’ve replaced the ISP router with your own hardware, make sure nothing on it is listening on 7547 at all, since you have no legitimate reason to run a CWMP management endpoint without an ISP operating it.

See our full guide, TR-069/CWMP: why ISPs use it and when it’s a risk, for more on how the 2016 incident unfolded and why it’s widely cited as the reason most ISPs now firewall this port.

Defensive use only

Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.