---
title: "NET-SVC-002 Control Plane or Remote Desktop Ports Network-Reachable"
canonical: https://openvapt.com/checks/NET-SVC-002.html
html: https://openvapt.com/checks/NET-SVC-002.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# NET-SVC-002 Control Plane or Remote Desktop Ports Network-Reachable

Docker API, Kubernetes API, kubelet, etcd, VNC or RDP listen on network-reachable addresses.

- Domain: Network
- Severity: Critical
- Control category: Network Exposure
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1327, CWE-923
- OWASP Top 10 2021: A05:2021
- NIST SP 800-53 Rev. 5: AC-17, CM-7, SC-7

## Why It Matters

These services hand out administrative control of the host or the cluster. The unauthenticated Docker API and etcd give code execution or every cluster secret to whoever connects; RDP and VNC are the most attacked remote access services.

## How It Detects

Parses local TCP and UDP socket tables and matches listeners bound to a non-loopback address against the default ports of these control planes and remote desktops. Severity follows the service identity: management panels and exporters are rated separately by NET-SVC-004. The binding (all interfaces, private or public address) is recorded as evidence. No packets are sent.

## How to Fix

Bind control planes to loopback or a dedicated management address, require mutual TLS or strong authentication, and filter access to approved source networks or a VPN.

## How to Verify

```
Review ss -tulpn and the host firewall from a trusted administrative session.
```

## Learn the Theory

- [P3 Network Exposure and Firewalls](https://openvapt.com/academy/p3.md)
- [P8 Data Services: Databases, File Shares, DNS and Mail](https://openvapt.com/academy/p8.md)

## References

- [Docker Protect the Daemon Socket](https://docs.docker.com/engine/security/protect-access/)
- [Kubernetes Ports and Protocols](https://kubernetes.io/docs/reference/networking/ports-and-protocols/)
- [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go

Run it: `openvapt scan --only NET-SVC-002`. Read it offline: `openvapt explain NET-SVC-002`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-SVC-002.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.