Port 902 – VMware (VMware ESXi Server)

Port 902 is the default port for the VMware ESXi host agent — the vmware-authd authentication daemon (the VMware Authorization Service) that fronts every ESXi host and legacy vCenter/vSphere connection. It authenticates management sessions and then carries the host’s real work: the NFC (Network File Copy) channel used for provisioning, cloning, cold migration, and ISO/VMDK uploads, and the MKS (mouse-keyboard-screen) protocol behind the VM remote console. TCP 902 handles that management and console traffic; UDP 902 carries the heartbeat an ESXi host sends back to vCenter. An open 902 is a reliable tell that you’re looking at a hypervisor — and a hypervisor is the highest-value box on the network, because owning the host means owning every guest VM on it.

Why It’s Open

ESXi hosts and vCenter Server need port 902 for day-to-day operations. vCenter reaches each ESXi host on 902/TCP for NFC — provisioning, cloning, cold migration, and uploading ISOs and VMDKs — while each host sends status heartbeats back to vCenter on 902/UDP. The legacy vSphere/VI client and the VM remote console (VMRC) also connect through 902, and agentless backup products like Veeam, NetBackup, and Arcserve ride the same NFC channel to read VM disks. So port 902 turns up anywhere VMware virtualization lives, and it’s often left reachable from far more of the network than it should be.

The modern vSphere Client is web-based and lives on HTTPS port 443, but 902 is still required host-side for console and file-copy traffic, so it stays open even on current builds. Where you find 902, its siblings are usually one scan away — check for the vSphere/host web client and SOAP API on port 443 and the OpenSLP discovery service on port 427.

Common Risks

• It marks a hypervisor. An open 902 says “ESXi host” more reliably than almost any other port. Compromise the host and every guest VM on it — domain controllers, databases, backups — is yours. That’s why mass scanners fingerprint 902 first and ransomware crews prioritise the hits.
• Version fingerprinting. The vmware-authd banner (and the SOAP API on 443) leaks the exact ESXi build. That build maps straight to a list of known ESXi CVEs — most of which actually land on the OpenSLP service (427) or vCenter, but the version you read off 902 tells an attacker which ones apply.
• Weak or default root credentials. vmware-authd validates host credentials and has no native rate limiting, so it’s brute-force friendly. ESXi hosts left on default or weak root passwords are common, and a valid host login is game over.
• Console and NFC traffic on the wire. Port 902 has required SSL since authd v1.10, but the console (MKS) and NFC channels were historically obfuscated rather than strongly protected, and VMware’s own hardening guidance treats the management and provisioning network as something to isolate. An attacker sharing that segment can target VM console keystrokes and disk-copy traffic.
• Denial of service. The daemon has a history of crash bugs (see the CVEs below) — a single malformed login can take the authentication service down for a host.
• Rarely the direct RCE, always the beacon. Be clear-eyed: 902’s own bug history is mostly DoS. The headline ESXi remote-code-execution bugs live on 427 (OpenSLP) and 443/vCenter. Port 902’s job in an attack is to identify the host and provide a credential-attack surface, then you pivot.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and grab the banner

nmap -sV -p 902 <target>

Raw banner grab with netcat

nc -nv <target> 902

A live vmware-authd answers with a banner like 220 VMware Authentication Daemon Version 1.10: SSL Required, ServerDaemonProtocol:SOAP, MKSDisplayProtocol:VNC, VMXARGS supported, NFCSSL supported — confirming an ESXi/VMware host and listing the console and file-copy protocols it speaks.

Negotiate the TLS layer (902 requires SSL)

openssl s_client -connect <target>:902

Brute-force the authentication daemon (Nmap NSE)

nmap -p 902 --script vmauthd-brute <target>

Fingerprint the ESXi/vCenter build via the SOAP API

nmap --script vmware-version -p 443 <target>

The vmware-version script queries the VMware SOAP API on port 443 (not 902) and returns the exact ESX/ESXi/vCenter build number — the fastest way to map a host to its CVEs.

Metasploit — VMware Authentication Daemon login scanner

msfconsole -q
use auxiliary/scanner/vmware/vmauthd_login
set RHOSTS <target>
set USER_FILE users.txt
set PASS_FILE passwords.txt
set STOP_ON_SUCCESS true
run

Log every open port 902, the exact build you read off the banner, and any credential that works, so it lands in the pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

Port 902’s own vulnerability history is mostly denial-of-service against the authentication daemon:

• CVE-2009-4811 — Format-string flaw in vmware-authd.exe (the VMware Authorization Service). A %-format sequence in the USER and PASS commands crashes the daemon — an unauthenticated remote DoS (CWE-134, CVSS 5.0). Affects VMware Workstation 6.5.x/7.0, Player 2.5.x/3.0, ACE, and Server 2.x.
• CVE-2009-0177 — A long USER or PASS command crashes vmware-authd (via vmwarebase.dll), another unauthenticated remote DoS (CVSS 5.0). Affects VMware Workstation 6.5.1, Player 2.5.1, ACE, Server 2.0.x, and Fusion; proof-of-concept on Exploit-DB 7647.

The famous ESXi remote-code-execution bugs people associate with “VMware” do not live on port 902 — get the scope right when you report them:

• CVE-2021-21974 — the ESXiArgs bug — is a heap overflow in the OpenSLP service on port 427 (CVSS 8.8, adjacent-network), not port 902. It’s covered on the port 427 page.
• CVE-2023-34048 — an out-of-bounds write in vCenter Server’s DCERPC implementation (CVSS 9.8, CISA KEV) — is a vCenter RPC-endpoint RCE, not the ESXi host agent on 902.
• CVE-2024-37085 — an ESXi Active Directory integration authentication bypass: an attacker with AD privileges re-creates the ESX Admins group to gain full host admin (CVSS 7.2, CISA KEV, exploited by ransomware crews in 2024). It’s a host/AD-integration flaw rather than a port-902 network bug, but it’s exactly why an exposed ESXi host is such a prized target.

Verified tooling for the port itself: Nmap’s vmauthd-brute and vmware-version NSE scripts and Metasploit’s auxiliary/scanner/vmware/vmauthd_login — there is no public unauthenticated RCE module against vmware-authd on 902.

Mitigation

• Never expose ESXi management to the internet. Ports 902, 443, and 427 should never be reachable from untrusted networks. Internet-facing ESXi is what the ESXiArgs and 2024 ransomware campaigns fed on.
• Isolate the hosts on a dedicated management VLAN. Restrict 902 (and all ESXi management) to vCenter, backup servers, and admin jump hosts by IP — nothing on a user or DMZ segment should reach it.
• Patch ESXi promptly. The build you can read off 902 is the same one attackers map to CVEs — keep hosts current, especially for the 427/OpenSLP and vCenter DCERPC fixes.
• Enforce strong, unique root credentials and enable lockdown mode. Kill default/shared passwords, use per-host root secrets, and turn on ESXi lockdown mode so direct host access is tightly controlled.
• Disable unused services. Turn off OpenSLP/CIM on 427 if you don’t need it (current ESXi ships SLP off), disable SSH and the ESXi Shell when not in use, and review AD integration given CVE-2024-37085.

Real-World Example

In February 2023 the ESXiArgs campaign encrypted thousands of internet-exposed VMware ESXi hosts worldwide in a matter of days. The actual entry point was the OpenSLP service on port 427 (CVE-2021-21974), not port 902 — but 902 was the beacon that flagged those boxes as ESXi hypervisors to mass scanners in the first place, putting them on the target list. A year later, ransomware operators were abusing CVE-2024-37085 to grant themselves instant ESXi admin through the ESX Admins Active Directory group. The through-line is the same: an exposed ESXi management surface is a top-tier prize because one host equals every VM it runs, and an open 902 is the flare that says “hypervisor here.”

FAQ

What is port 902 used for?

Port 902 is the management port for VMware ESXi. The vmware-authd daemon authenticates connections, then the port carries NFC (Network File Copy) traffic for provisioning, cloning, migration, and backups, plus the MKS protocol behind the VM remote console. TCP 902 handles management and console traffic; UDP 902 carries host-to-vCenter heartbeats.

Is port 902 dangerous?

It’s not usually a direct remote-code-execution target — its own bug history is mostly denial-of-service — but an open 902 marks a hypervisor, the highest-value host on the network. It leaks the ESXi build for CVE mapping, exposes vmware-authd to credential brute-forcing, and signals an ESXi host whose bigger bugs live on ports 427 and 443. Treat any internet-facing 902 as a serious exposure.

What service runs on port 902?

The VMware ESXi host agent — specifically vmware-authd (the VMware Authorization Service). It authenticates vCenter, backup, and console sessions and brokers the host’s NFC and MKS channels.

Is port 902 TCP or UDP?

Both. TCP 902 carries the authenticated management, NFC, and console (MKS) traffic between vCenter/clients and the ESXi host. UDP 902 is used by the ESXi host to send status heartbeats back to vCenter Server.

How do I secure or close port 902?

Don’t expose it to the internet. Restrict 902 to a management VLAN reachable only by vCenter, backup servers, and admin hosts; enable ESXi lockdown mode; set strong unique root passwords; and keep hosts patched. If a host doesn’t need vCenter management or agentless backup, you can firewall 902 off, then rescan with nmap -p 902 <target> to confirm it’s closed.

TL;DR

• Service: VMware ESXi host agent (vmware-authd / VMware Authorization Service)
• Default port: 902/TCP (management, NFC, MKS console) and 902/UDP (host-to-vCenter heartbeat)
• Biggest risk: it marks a hypervisor — version fingerprinting, credential brute force, and a pivot to the guests; the big RCEs are on 427 and 443, not 902
• Mitigation: keep ESXi management off the internet, isolate on a management VLAN, patch, strong unique root + lockdown mode, disable unused services