UDP 17185
Synopsis
- UDP port 17185 is used by Wind River VxWorks’ WDB (Wind DeBug) remote debugger service, often referred to as WDBRPC.
- Wind River Tornado and Workbench IDEs connect to VxWorks targets over this port to download code, set breakpoints, and read/write memory during development.
- In practice, numerous VxWorks-based embedded and industrial devices have exposed this port in production, which has been documented in US-CERT/ICS-CERT advisories concerning the VxWorks WDB agent.
- This port has been associated with exploitation: older WDB agents lacked authentication, and public tools (including Metasploit modules targeting wdbrpc over UDP/17185) enable unauthenticated memory access and remote code execution.
- Administrators typically mitigate by disabling the WDB agent on deployed systems or filtering UDP 17185.
Observed activity
Last 30 days
Detailed chart