Port 10000 – Webmin (Web-Based Unix/Linux System Administration)

Port 10000 is best known as the default port for Webmin, the web-based control panel for administering Unix and Linux systems from a browser — managing users, services, packages, cron jobs, firewall rules, and the filesystem, all through a single HTTPS interface. Its siblings Usermin (per-user mail and account management) and Virtualmin (web hosting on top of Webmin) live in the same family. Webmin’s built-in web server, MiniServ, speaks HTTPS by default with a self-signed certificate, so an open 10000 that answers TLS and returns a MiniServ banner is almost certainly Webmin. It is not the only tenant, though: 10000 is IANA-registered as ndmp (Network Data Management Protocol, used by backup products), Veritas/BackupExec agents appear here, and various custom apps and RTP/VoIP media ranges begin at 10000 too. So the first job on an open port 10000 is to confirm what is listening — but on the public internet, the answer is usually Webmin, and that matters because Webmin runs as root.

Why It’s Open

Webmin is deliberately exposed on 10000 by administrators who want to manage a box without an SSH session — it is popular on VPS hosts, small business servers, and hosting stacks (Virtualmin/Cloudmin) precisely because it puts a full system-admin GUI one login away. Because it manages the whole operating system, the Webmin daemon (miniserv.pl) typically runs as root, and the web UI can do anything root can: add users, edit /etc/shadow, install packages, run arbitrary commands.

The same port number is registered and used by other services, which is why identification comes first:

• NDMP (ndmp, the IANA assignment for 10000/TCP) — a control protocol backup products use to move data between servers and storage.
• Veritas/Symantec BackupExec agents and other backup/management agents.
• Usermin on 10000 in some setups (Webmin’s per-user companion usually defaults to 20000, but deployments vary), plus assorted custom apps and media/RTP ranges that start at 10000.

Like other browser-based admin consoles, Webmin is sometimes moved behind or fronted by other web ports — a reverse proxy on 8443 or 8080 — but 10000 remains its out-of-the-box default.

On a hardened network Webmin should sit behind a VPN or an IP allowlist. Where 10000 is answering to the whole internet, it usually means a convenience install that was never locked down — which is exactly the population that gets scanned and popped.

Common Risks

• Runs as root — compromise equals instant root. Webmin’s whole purpose is privileged administration, so any authentication bypass or code-execution bug on 10000 hands the attacker a root shell, not a low-privilege foothold. There is no privilege gap left to climb.
• Unauthenticated remote code execution. Webmin’s history includes a build-server backdoor (CVE-2019-15107) that gave unauthenticated RCE as root to anyone who could reach 10000 — no login required.
• Post-authentication RCE by design surface. Legitimate modules (Package Updates, File Manager, running processes) execute commands as root, so weak access control or an authenticated bug in any of them (CVE-2019-12840, CVE-2020-35606, CVE-2022-0824, CVE-2012-2982) becomes root command execution.
• Weak or default credentials + no rate limiting. An exposed login form invites brute force; a single valid low-privilege Webmin account can often be escalated through a vulnerable module.
• Self-signed TLS and version leakage. MiniServ presents a self-signed certificate (users are trained to click through the warning) and its Server: header frequently leaks the exact Webmin version, telling an attacker precisely which exploit to load.
• CSRF against a root-privileged UI. Because the UI acts as root, a cross-site request forgery flaw (CVE-2021-31760) can turn a tricked admin’s browser into a remote-command channel.
• Mistaking the service. Treating an open 10000 as “just NDMP/backup” when it is actually an unpatched Webmin (or vice versa) means testing the wrong thing entirely.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The first task is to confirm whether 10000 is Webmin, NDMP, or something else, then fingerprint the exact Webmin version — the version alone decides which of the exploits below apply.

Detect the service and version

nmap -sV -p 10000 <target>

nmap -sV will label the port ndmp for a backup service or identify the Webmin/MiniServ HTTP(S) server. Add a few safe NSE scripts to pull the certificate and headers:

nmap -sV -p 10000 --script "banner,ssl-cert,http-headers" <target>

Fingerprint Webmin over HTTPS (note the self-signed cert)

Webmin speaks HTTPS by default, so use -k to accept the self-signed certificate. The Server: header reveals MiniServ and, very often, the exact Webmin version:

curl -k -sI https://<target>:10000/
# look for: Server: MiniServ/1.920

Fetch the login page to confirm it’s Webmin (vs. Usermin/Virtualmin) and to read any version string in the page:

curl -k -s https://<target>:10000/ | grep -iE "webmin|usermin|virtualmin|version"

Check for the 2019 backdoor (CVE-2019-15107)

Metasploit ships a verified module for the unauthenticated password_change.cgi backdoor. Use its built-in check before firing:

msfconsole -q
use exploit/linux/http/webmin_backdoor
set RHOSTS <target>
set RPORT 10000
set SSL true
check

Post-authentication RCE modules (need valid Webmin creds)

# Package Updates module -> root command execution (CVE-2019-12840; bypass CVE-2020-35606)
use exploit/linux/http/webmin_packageup_rce

# Older file/show.cgi command injection (CVE-2012-2982)
use exploit/unix/webapp/webmin_show_cgi_exec

TLS review and login brute force

sslscan <target>:10000
hydra -L users.txt -P passwords.txt https-post-form \
  "<target>:10000/session_login.cgi:user=^USER^&pass=^PASS^:Login failed"

Record every open port 10000, the confirmed service and version, the self-signed certificate details, and any credential or check result as you go, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

Webmin’s exposure is unusually high-stakes because miniserv.pl runs as root — every flaw below results in root code execution, not a low-privilege foothold. Confirm the Webmin version first, then match it to the relevant CVE:

• CVE-2019-15107 — The headline. Webmin ≤ 1.920 shipped a backdoor: the old parameter in password_change.cgi contains an unauthenticated OS command injection, giving remote code execution as root with no login. CVSS 9.8, and listed in CISA’s Known Exploited Vulnerabilities catalog. Weaponised in Metasploit as exploit/linux/http/webmin_backdoor and archived as Exploit-DB 47230 (Metasploit module) and Exploit-DB 47293 (standalone script). Only 1.890 is exploitable in a default install; 1.900–1.920 require the “expired password change” feature to be enabled.
• CVE-2019-12840 — Webmin ≤ 1.910: any user authorised for the Package Updates module can execute arbitrary commands as root via the data parameter to update.cgi. Post-authentication, CVSS 8.8. Metasploit module exploit/linux/http/webmin_packageup_rce.
• CVE-2020-35606 — Webmin ≤ 1.962: an incomplete fix for the Package Updates issue above; the same root command execution is reachable via %0A/%0C characters. Post-authentication, CVSS 8.8.
• CVE-2022-0824 — Webmin < 1.990: improper access control leads to post-authentication remote code execution — a low-privilege user can reach functionality that runs as root. CVSS 8.8.
• CVE-2021-31760 — Webmin 1.973: a cross-site request forgery flaw in the running-process feature that a tricked administrator’s browser can be forced into using to achieve remote command execution. CVSS 8.8.
• CVE-2012-2982 — Webmin ≤ 1.590: file/show.cgi allows a remote authenticated user to run arbitrary commands via an invalid character (e.g. a | pipe) in a pathname. CVSS v2 6.5. Metasploit module exploit/unix/webapp/webmin_show_cgi_exec; Exploit-DB 21851.

Corrections to the previous version of this page. The old page described CVE-2021-31760 as “arbitrary file read in the file manager module” — it is actually a CSRF-to-RCE issue — and described CVE-2022-0824 as “cross-site scripting” — it is actually an improper-access-control post-authentication RCE. Both are corrected above. We also excluded CVE-2022-0825, sometimes grouped with these: that CVE is in the Amelia WordPress plugin, not Webmin, and has nothing to do with port 10000. CVE-2019-15231 was rejected by NVD as a duplicate of CVE-2019-15107 and is not listed separately. Always verify a CVE against its NVD record and confirm the product before trusting it.

Mitigation

• Keep it off the public internet. Bind Webmin to a management interface, put it behind a VPN, or restrict 10000 to trusted admin IPs in both the firewall and Webmin’s own IP Access Control settings. A root-privileged panel should never accept connections from the whole internet.
• Patch to the current release. The backdoor (CVE-2019-15107) and the Package Updates/module RCEs are all fixed in later versions — run a supported Webmin and apply updates promptly.
• Enforce strong, unique credentials and 2FA. Change any default account, use long unique passwords, and enable Webmin’s two-factor authentication for the admin login.
• Rate-limit and block brute force. Enable Webmin’s failed-login lockout and front it with fail2ban so an exposed login form can’t be hammered.
• Reduce the module surface. Remove or restrict powerful modules (Package Updates, File Manager, Command Shell, running processes) for accounts that don’t need them, so a stolen low-privilege login can’t reach a root RCE path.
• Fix the TLS. Replace the self-signed MiniServ certificate with a real one, disable weak ciphers, and stop training users to click through certificate warnings on HTTPS admin panels.
• Identify the real service before hardening. If 10000 is actually NDMP/BackupExec rather than Webmin, secure the backup agent instead — don’t assume every open 10000 is a web panel.
• Prefer SSH for administration where a browser panel isn’t required, and close 10000 entirely if nothing legitimately needs it — then rescan to confirm.

Real-World Example

In August 2019, researcher Özkan Mustafa Akkuş disclosed at DEF CON 27 that Webmin had shipped with a backdoor in its official release tarballs — the flaw that became CVE-2019-15107. Unknown attackers had compromised Webmin’s build infrastructure and inserted Perl qx command-execution code into password_change.cgi: the malicious code was present in the distributed downloads on SourceForge but not in the project’s source repository, so it evaded casual code review for over a year. Any internet-facing Webmin 1.890 (and 1.900–1.920 with the expired-password feature on) could be handed a single crafted request to password_change.cgi and would run the attacker’s command as root, with no authentication. Tens of thousands of instances were exposed on 10000 worldwide, a Metasploit module landed within days, and the bug was quickly weaponised at scale. It is the definitive port-10000 lesson: the panel’s convenience is inseparable from its danger — because Webmin is root, a supply-chain slip in its build turned an admin tool into an internet-wide root-shell dispenser overnight.

FAQ

What is port 10000 used for?

Port 10000 is the default port for Webmin, a web-based system-administration panel for Unix and Linux, along with its relatives Usermin and Virtualmin. Webmin serves its interface over HTTPS (via its built-in MiniServ web server) and runs with root privileges so it can manage the whole operating system. The same port number is also IANA-registered as ndmp for network backup, and is used by BackupExec agents and some custom apps — so an open 10000 should be fingerprinted before it’s assumed to be Webmin.

Why is port 10000 open on my server?

Most often because Webmin (or Virtualmin) is installed and listening for browser-based administration. It can also be a backup agent speaking NDMP, or another application that picked 10000. Run curl -k -sI https://<host>:10000/ — a Server: MiniServ header confirms Webmin; nmap -sV -p 10000 <host> will tell you if it’s a backup/NDMP service instead.

Is port 10000 safe to leave open?

Not to the public internet. Webmin runs as root, so any bug on 10000 is a root compromise, and the port has a documented history of unauthenticated RCE (CVE-2019-15107). A patched Webmin restricted to a VPN or an admin IP allowlist, with strong credentials and 2FA, is reasonable. An internet-facing, unpatched, or default-credential Webmin on 10000 is a high-priority finding.

How do I check the Webmin version on port 10000?

Fingerprint the MiniServ banner: curl -k -sI https://<host>:10000/ usually returns a Server: MiniServ/x.xxx header whose version tracks the Webmin release, and nmap -sV -p 10000 <host> will also report it. Versions 1.890–1.920 are the range affected by the CVE-2019-15107 backdoor, so identifying the version tells you immediately which exploits to test.

Does Webmin use HTTP or HTTPS on port 10000?

HTTPS by default, using a self-signed certificate from its built-in MiniServ server — which is why browsers throw a certificate warning and tools need curl -k / --script ssl-cert to inspect it. Webmin can be configured for plain HTTP, but the default and recommended setup is TLS. Replace the self-signed certificate with a trusted one so users aren’t conditioned to ignore warnings.

How do I secure or close port 10000?

Restrict it to trusted admin networks in both the host firewall and Webmin’s IP Access Control, patch to a current release, set strong unique credentials with 2FA, enable failed-login lockout (and fail2ban), and trim powerful modules from low-privilege accounts. If a browser panel isn’t needed, administer over SSH instead, stop the Webmin service, and rescan with nmap -p 10000 <host> to confirm the port is closed.

TL;DR

• Service: Webmin (with Usermin/Virtualmin) — a root-privileged, HTTPS web-based Unix/Linux admin panel served by MiniServ; port 10000 is also IANA-registered as ndmp for network backup, so identify the service first
• Default port: 10000/TCP (HTTPS by default, self-signed certificate)
• Biggest risk: Webmin runs as root, so any flaw is instant root RCE — most infamously the CVE-2019-15107 build-server backdoor that gave unauthenticated root code execution to anyone who could reach the port
• Mitigation: keep it off the public internet (VPN/IP allowlist), patch to a current release, enforce strong credentials + 2FA, restrict powerful modules, replace the self-signed TLS cert, and close 10000 if nothing needs it