Port 902 – VMware ESXi

TCP

Port 902 is the VMware ESXi host client and console port used by vSphere Client for VM console access (VMRC) and NFC data transfers. VMware uses port 902 for the legacy thick client connection and virtual machine console proxy. Restrict to management networks – exposed ESXi management ports enable full hypervisor compromise.

Port Number

902

Protocol

TCP

Service

VMware Authentication / Console

Range

IANA Registered (1024–49151)

Description

VMware ESXi uses port 902 for multiple functions: the legacy vSphere thick client connection, VM console access via VMRC (Virtual Machine Remote Console), and NFC (Network File Copy) for datastore file operations. The vSphere Web Client uses port 443 instead, but port 902 remains required for console access. Exposing port 902 to the internet is extremely dangerous. ESXi management access enables full control of all virtual machines on the host. Ransomware groups (Royal, BlackBasta, ESXiArgs) specifically target exposed ESXi ports. Place all ESXi management (ports 443, 902, 5989) on an isolated management VLAN with jump-box access only.

Security risks

1CVE-2021-21974: VMware ESXi OpenSLP heap overflow RCE – exploited by ESXiArgs ransomware campaign (Feb 2023) encrypting thousands of VMs worldwide via exposed port 427/902
2CVE-2023-20867: VMware Tools authentication bypass – allows low-privilege attacker on guest VM to escalate to ESXi host (VM escape via VMX process on port 902)
3Direct VMRC/console access: port 902 provides virtual machine console access. Without MFA on vCenter, a stolen password gives direct VM keyboard/screen access to every VM on the host
4NFC (Network File Copy) on port 902: used for VM provisioning – unprotected access allows downloading VMDK disk images (full VM disk contents including OS, data, credentials)
5ESXi has no built-in brute-force protection: SSH/902 login attempts are not rate-limited by default, making credential stuffing effective against weak root passwords

Firewall guidance

NEVER expose port 902 to the internet. The ESXiArgs ransomware campaign (2023) exploited exposed ESXi hosts globally. Place ESXi management on a dedicated VLAN unreachable from user networks. Access only via VPN + vCenter. Disable SLP (port 427) on all ESXi hosts: /etc/init.d/slpd stop && chkconfig slpd off. Enable ESXi lockdown mode to restrict API access to vCenter only.

Diagnosis commands

Check which management ports are open (427 should be closed)

shell

nmap -p 902,443,427 --open esxi-host

List ESXi local accounts (check for unauthorized accounts)

shell

esxcli system account list

Audit ESXi firewall rulesets (check for overly permissive rules)

shell

esxcli network firewall ruleset list | grep -i enabled

Check if lockdown mode is enabled (should be 'normal' or 'strict')

shell

vim-cmd hostsvc/hostsummary | grep -i lockdown

Usage examples

Port 902 – VMware ESXi

shell

vmware-cmd -l
esxcli network firewall ruleset list
nmap -p 902 esxi-host

Common services on this port

VMware ESXiVMware vCenter ServerVMware Workstation (host-guest)VMRC (Virtual Machine Remote Console)

Related ports

443

vCenter/ESXi web UI (HTTPS)

902

ESXi console/NFC (this port)

903

ESXi VMRC (remote console)

427

SLP (ESXi service discovery, disable!)

ESXi SSH (disabled by default)

History

Port 902 has been used by VMware since ESX 2.x (early 2000s) for the VM console protocol and NFC (Network File Copy). ESXi's attack surface increased dramatically as ransomware groups discovered that many organizations expose ESXi management to the internet. The ESXiArgs campaign (February 2023) was a mass exploitation event – automated scanning for port 427 (SLP) led to RCE on unpatched ESXi 6.x/7.x hosts, encrypting VMs for ransom.

FAQ

How do I protect ESXi from ransomware?

1. Never expose ports 443/902/427 to the internet (ESXi management on isolated VLAN only). 2. Patch immediately (ESXi 7.0U3/8.0 fix CVE-2021-21974). 3. Disable SLP: /etc/init.d/slpd stop && esxcli network firewall ruleset set -e false -r CIMSLP. 4. Enable lockdown mode (restricts direct host access, forces vCenter-only management). 5. Disable SSH when not actively debugging. 6. Strong root password (20+ chars). 7. VM-level backups stored off-host (Veeam, Commvault).

What is port 902 used for exactly?

Port 902 serves two functions: (1) Virtual Machine Remote Console (VMRC) – keyboard/mouse/screen access to VMs, used by vCenter/Workstation to display VM consoles. (2) Network File Copy (NFC) – transfers VM disk files (VMDK), ISO images, and OVF templates during provisioning, cloning, and vMotion. Both use authenticated TLS but the authentication is only as strong as the ESXi root password or vCenter service account.