Port 7547 – CWMP / TR-069 (CPE WAN Management Protocol)

Port 7547 is the default port for CWMP / TR-069 (CPE WAN Management Protocol), the SOAP-over-HTTP protocol an ISP’s Auto-Configuration Server (ACS) uses to remotely provision and manage subscriber customer-premises equipment (CPE) — home routers, DSL and cable modems, VoIP ATAs, and set-top boxes. The CPE runs a small CWMP client that listens on port 7547 for the ACS’s connection requests; the ACS can then push firmware, rewrite configuration, and read device state without any user interaction. Because it sits on the ISP-facing WAN side of hundreds of millions of devices, an exposed or buggy CWMP endpoint is one of the largest remote-management attack surfaces on the consumer internet.

Why It’s Open

TR-069 is how ISPs manage the boxes they ship to subscribers at scale — zero-touch provisioning, firmware rollouts, remote diagnostics, and support-desk troubleshooting all run over CWMP. So on ISP-provisioned CPE, port 7547 is open by design: the device has to be reachable for the ACS to call it. In a correct deployment that reachability is scoped to the ISP’s own network — the CPE only accepts CWMP from the ACS, over TLS, on the provider’s management plane.

The problem is how often that scoping fails. Large fleets of CPE have historically answered on port 7547 from the entire internet, either because the firmware bound the CWMP service to the WAN interface without an ACL, or because the ISP never restricted it. Once 7547 is internet-facing, every flaw in the device’s CWMP daemon — or in the embedded web server behind it — becomes remotely reachable by anyone, not just the provider. The related management stack often overlaps with the CPE web UI on port 80 and 443, and the same devices frequently expose Telnet on port 23 too.

Common Risks

• Internet-exposed management endpoint. 7547 is meant to be reachable only from the ISP’s ACS. When it answers the whole internet, a single flaw in the CWMP client lets an attacker push configuration or firmware to the device — mass device takeover, not a one-off.
• TR-064 / CWMP command injection. Several CPE stacks pass ACS-supplied values (classically NewNTPServer / SetNTPServers) straight into a shell. An unauthenticated SOAP request on port 7547 then runs arbitrary commands as root — the exact bug weaponised against DSL modems in 2016.
• Vulnerable embedded web server. Many CPE serve CWMP through Allegro RomPager, whose “Misfortune Cookie” flaw lets a crafted cookie corrupt memory and hand an attacker administrative control of the device’s HTTP stack.
• Rogue or spoofed ACS. CWMP should run over TLS with an authenticated ACS. Plaintext or unauthenticated CWMP lets a man-in-the-middle or rogue ACS impersonate the provider and own the CPE; weak connection-request credentials make this worse.
• Information disclosure. CWMP exposes a rich device data model — model, firmware version, serial, MAC, sometimes Wi-Fi and admin credentials — which malformed or unauthenticated queries can leak and fingerprint for follow-on exploitation.
• Botnet recruitment. TR-069/TR-064 command injection over 7547 has been mass-exploited by Mirai and its Annie variant to enlist routers into DDoS botnets.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detection is unreliable — plain service scans often can’t fingerprint a CWMP endpoint, so treat an open 7547 as CWMP until proven otherwise and probe the HTTP layer directly.

Detect the service and grab the banner

nmap -sV -p 7547 <target>

Probe the HTTP/SOAP layer

curl -sik http://<target>:7547/ -A "" -H "Content-Type: text/xml"

Raw connection check with netcat

nc -nv <target> 7547

Scan for the RomPager “Misfortune Cookie” flaw

msfconsole -q
use auxiliary/scanner/http/allegro_rompager_misfortune_cookie
set RHOSTS <target>
set RPORT 7547
run

Test the TR-064 NewNTPServer command injection

use exploit/linux/http/tr064_ntpserver_cmdinject
set RHOSTS <target>
set RPORT 7547
run

Check the RomPager authentication bypass

use auxiliary/admin/http/allegro_rompager_auth_bypass
set RHOSTS <target>
set RPORT 7547
run

Log every internet-facing 7547 and every device that answers an unauthenticated CWMP request so the evidence lands in the pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• CVE-2016-10372 — The Zyxel/Eir D1000 modem fails to restrict TR-064, so an unauthenticated attacker runs arbitrary commands over TCP 7547 by injecting into the NewNTPServer value. CVSS v3 9.8. This is the flaw behind the November 2016 mass-router attack. Weaponised as Metasploit’s exploit/linux/http/tr064_ntpserver_cmdinject and Exploit-DB 40740.
• CVE-2014-9222 — “Misfortune Cookie.” A crafted HTTP cookie corrupts memory in Allegro RomPager 4.34 and earlier (widely embedded in home gateways, reachable on the CWMP web stack), letting an attacker gain administrative control of the device. CVSS v2 10.0. Scan with auxiliary/scanner/http/allegro_rompager_misfortune_cookie.
• CVE-2014-9223 — The companion RomPager flaw: multiple buffer overflows in authorization handling in RomPager 4.07 and earlier allow denial of service or possible code execution. CVSS v2 10.0. Related tooling: auxiliary/admin/http/allegro_rompager_auth_bypass.
• CVE-2024-56316 — A current ACS-side flaw: unsanitized input in the TR-069 API of AXESS ACS (through 5.2.0) lets a remote, unauthenticated attacker cause a permanent denial of service via crafted TR-069 requests on TCP 7547 (or 9675) — a reboot does not clear it. CVSS v3.1 7.5. A reminder that the ACS itself is a target, not just the CPE.

Note: CVE-2017-17215 (Huawei HG532 RCE) is frequently mis-cited as a port 7547 bug, but the exploit is actually delivered to the UPnP service on port 37215, not the CWMP port — verify the port before attributing it here.

Mitigation

The asset owner here is usually the ISP, not the subscriber — CWMP is an operator responsibility, so the primary fixes belong to whoever runs the ACS and ships the CPE.

• Never expose 7547 to the whole internet. CPE should accept CWMP connection requests only from the ISP’s ACS IP ranges. ACL/allowlist those addresses at the CPE and at the network edge, and confirm 7547 is not answering from arbitrary WAN sources.
• Require TLS and an authenticated ACS. Run CWMP over HTTPS with certificate validation and strong, per-device connection-request credentials so a rogue or MITM ACS can’t impersonate the provider.
• Patch the CPE firmware. Keep the CWMP daemon and its embedded web server (RomPager and similar) updated — the Misfortune Cookie and TR-064 injection bugs are all firmware-level fixes.
• Segment the management plane. ISPs should isolate ACS/CWMP traffic on a dedicated management network, separate from subscriber and internet traffic.
• Disable remote management where the device allows it. Most subscribers can’t change ISP-managed CWMP settings — that’s worth stating honestly — but where the CPE exposes a “remote management / TR-069” toggle and the ISP doesn’t need it, turning it off removes the exposure.

Real-World Example

On 27 November 2016, roughly 900,000 Deutsche Telekom customers lost their internet connections. The cause was a Mirai variant (dubbed “Annie”) scanning the internet for port 7547 and sending a TR-064 SOAP request whose NewNTPServer1 field carried a command-injection payload — the same class of bug as CVE-2016-10372 — intended to download and run malware on the router. The twist: Deutsche Telekom’s Speedport routers weren’t actually infected. Their CWMP implementation choked on the flood of malformed connection requests and crashed instead of executing the payload, turning an attempted mass-takeover into a mass outage. It remains the landmark demonstration of why an internet-reachable TR-069 port is a fleet-wide risk: one crafted packet class, aimed at hundreds of thousands of devices at once, over a port that was only ever meant to talk to the ISP.

FAQ

What is port 7547 used for?

Port 7547 is the default port for CWMP (CPE WAN Management Protocol), also called TR-069. ISPs use it to remotely manage the routers and modems they provision — pushing firmware, changing configuration, and reading device status from an Auto-Configuration Server (ACS) without the subscriber doing anything.

Is port 7547 dangerous?

It’s dangerous when it’s reachable from the public internet. 7547 is meant to accept connections only from the ISP’s ACS; when it answers the whole internet, flaws in the device’s CWMP daemon or embedded web server become remotely exploitable — as the 2016 attack on ~900,000 Deutsche Telekom routers showed. Scoped to the ISP’s management network and secured with TLS, it’s a normal management port.

What is the difference between TR-069 and TR-064?

TR-069 (CWMP) is the WAN-side protocol an ISP’s ACS uses to manage CPE over port 7547. TR-064 is a related LAN-side configuration protocol. The 2016 attacks abused the fact that many devices accepted TR-064 commands over the TR-069 port 7547 from the internet — a combination that was never supposed to be reachable.

Can I close port 7547 on my router?

Usually not directly — on ISP-provisioned equipment, CWMP is managed by the provider and the setting is often locked. Where the device exposes a “remote management” or “TR-069” toggle and your ISP doesn’t rely on it, disabling it removes the exposure. Otherwise the fix is the ISP’s: allowlist the ACS, enforce TLS, and keep firmware patched.

TL;DR

• Service: CWMP / TR-069 (CPE WAN Management Protocol) — ISP remote management of home routers and modems
• Default port: 7547/TCP
• Biggest risk: internet-exposed CWMP → TR-064 command injection and RomPager flaws → mass CPE takeover
• Mitigation: allowlist the ACS, enforce TLS + authenticated ACS, patch CPE firmware, segment the management plane