12346 open port

Doug

I bought Tenda branded powerline adapters to get a wired connection to a new PC. Running a Fing scan I've found that there is an open port, 12346 Netbus backdoor trojan. This sounds worrying - is it?

rooted

That is going to be a smart device, such as a lightbulb or plug.

Marc

you might consider contacting the manufacturer, as this could be an unregistered port they utilize.  Others have seen this behavior as well.  https://community.home-assistant.io/t/lifesmart-cololight-modular-lights-support/101420

Marc

@Doug on the surface this is worrying.  I can't find any relationship between the port and tenda as a default configuration.  And as far as that port is concerned, lots of Trojans using it etc..  You could try to reset the power line adapter to factory defaults and refresh it or you could just return it if it's not too late.  Another avenue to pursue is to call the adapters support line and see what they say.  Regardless, I would avoid using it till this is cleared up.  The rest of the folks on Fing, care to chime in?  @rooted , @kltaylor thoughts?

rooted

I would contact Tenda and ask them about the open port and what it's for.

https://www.tendacn.com/us/service/page/technicalsupport.html

Have you scanned your network externally?

Doug

Thanks for quick responses. I've removed the powerline adapters and still have the same open port - rooky error of spotting the port on the same day I installed the adapters (sorry Tenda).
I'm now progressively powering down other connected devices but have not got to the bottom of it yet. It's showing up as Node-9EBFE9 on my router manager and Fing identifies the manufacturer as Espressif. My router manager won't let me delete it but I have stopped it from connecting to the internet until I figure out what is going on.

Doug

Thanks @rooted. It is a Cololight Pro-Smart LED panel light that is the source. I've unplugged it and now need to figure out if it is a risk before doing anything else.

rooted

You're welcome, if my post answered your question you can select the option underneath the post.

rooted

Your duckduckgo-fu is better than mine.

Marc

rooted said:

Your duckduckgo-fu is better than mine.

  

kltaylor

I honestly think @Doug, that you're moving in the right direction.  Shut down anything that's connecting to your network until you find the culprit. If this were me, even with this being a possible false-positive, I would still eliminate it from my network and open a dialog with the manufacturer of said device.