Port 2404 – IEC 60870-5-104 (IEC-104)

Port 2404 is the default port for IEC 60870-5-104 — usually shortened to IEC-104 — the TCP/IP telecontrol protocol that connects electric-power SCADA control centers to the RTUs and gateways sitting in substations. It is the networked form of the older serial IEC 60870-5-101 standard: the same application layer (ASDUs — Application Service Data Units) wrapped in an APCI header and carried over a standard TCP connection on port 2404. IEC-104 is the dominant telecontrol protocol across European and Asian transmission and distribution grids, and it does exactly what its name says — telecontrol. A control center reads telemetry out of a substation (breaker positions, bus voltages, measured values) and sends commands back to it (open a breaker, close a switch, change a setpoint). Crucially, the base standard has no authentication and no encryption of any kind: anyone who can complete a TCP handshake to port 2404 and start data transfer can read the station’s ASDU telemetry and, with the right control ASDU, operate its physical equipment. An open port 2404 is not a web service to fuzz — it is a direct control channel to operational-technology (OT) equipment that runs a power grid.

Why It’s Open

Port 2404 is open because a substation is doing its job. IEC-104 is how a control center’s SCADA master talks to the field: RTUs, protection relays, bay controllers, and telecontrol gateways from vendors such as Siemens, ABB/Hitachi Energy, Schneider Electric, GE, and many regional OEMs run an IEC-104 server (a “controlled station”) listening on 2404, and the SCADA front-end (“controlling station”) connects out to poll them. A typical session begins with a STARTDT U-format frame to enable data transfer, followed by a general interrogation (C_IC_NA_1, type 100) that dumps every point the RTU knows about; from then on the RTU spontaneously reports changes and the master issues commands as needed.

The protocol was designed for a private, physically protected wide-area telecontrol network — leased lines, dedicated fiber, or an isolated utility WAN where every node was trusted and reachable only over the utility’s own infrastructure. That assumption has eroded. Substation automation now rides IP; remote-engineering, cellular backhaul, and shared corporate networks have crept into OT; and misconfigured firewalls, flat networks, and internet-exposed telecontrol gateways put port 2404 within reach of attackers. Internet-wide scanners (Shodan, Censys) regularly return IEC-104 endpoints answering on 2404 directly from public IPs. There is no login to defeat — if the port answers STARTDT, the station is talking.

Common Risks

• No authentication in the base standard. IEC 60870-5-104 has no concept of a user, password, or session key. Reaching port 2404 is the authorization — there is nothing to brute-force because there is nothing to log into. Security was left to IEC 62351 (TLS + authentication), which is bolted on separately and frequently not deployed.
• No encryption. ASDUs — including live measured values and the commands that move equipment — travel in cleartext and can be sniffed, replayed, or manipulated by anyone on the path.
• Unauthenticated control of grid equipment. Control ASDUs such as single command (C_SC_NA_1, type 45) and double command (C_DC_NA_1, type 46) let a peer operate breakers and switches; regulating-step (C_RC) and set-point (C_SE) commands change other outputs. An attacker who reaches 2404 can trip breakers and de-energize feeders.
• Telemetry disclosure and process mapping. A single general interrogation returns the full point list — every information-object address, its type, and its current value — handing an attacker a complete map of the substation’s monitored and controllable points.
• Spoofing and replay. With no integrity or authenticity checks, a forged or replayed frame is indistinguishable from a legitimate one, so an on-path attacker can inject commands or feed the operator’s HMI fake “normal” readings while manipulating the process underneath.
• Fragile stacks. Many RTU and library implementations parse malformed APCI/ASDU frames poorly, so a single crafted packet can crash the telecontrol process and cut the control center’s visibility and control of the station (see the CVEs below).

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

IEC-104 testing is OT testing: a read (interrogation) is usually safe, but control ASDUs operate real power equipment and can trip breakers, de-energize feeders, and endanger people and hardware. Only ever touch equipment you are explicitly authorized to test, and keep any command/write operation to a lab, a simulator, or an agreed maintenance window — never a live grid RTU.

Confirm the service and version

nmap -sV -p 2404 <target>

Identify and interrogate with the IEC-104 NSE script

Nmap ships iec-identify, which probes port 2404 with a TESTFR frame, sends STARTDT, and runs a general interrogation to enumerate the ASDU (common) address and the information-object addresses the station exposes. It is categorized intrusive — it starts data transfer on the target — so treat it as an active operation:

nmap -Pn -n --script iec-identify --script-args='iec-identify.timeout=1000' -p 2404 <target>

Send IEC-104 frames with Metasploit

The Rapid7 tree ships an IEC-104 client at auxiliary/client/iec104/iec104 (note the path — it lives under client/iec104, not scanner/scada). It can connect, start data transfer, and build/send control ASDUs by type and value. Use it read-first, and treat command types as destructive on live gear:

msfconsole -q
use auxiliary/client/iec104/iec104
set RHOST <target>
set RPORT 2404
# ASDU_ADDRESS / COMMAND_ADDRESS / COMMAND_TYPE / COMMAND_VALUE configure the frame
show options
run

Drive a real IEC-104 client (lib60870)

MZ Automation’s open-source lib60870 implements CS 104 (IEC-104). Its cs104_client example (simple_client) connects to a controlled station, issues a general interrogation, and can send commands — the cleanest way to demonstrate exactly what an unauthenticated peer can read and do:

# Build the lib60870-C examples, then run the CS104 client against the station
./simple_client <target>   # sends STARTDT + general interrogation (C_IC_NA_1)

Decode the traffic

Wireshark’s built-in 104apci and 104asdu dissectors parse the APCI framing and the ASDU payload, so you can read type IDs, cause of transmission, and object values off the wire. For crafting and fuzzing frames, Scapy ships an IEC-104 layer at scapy.contrib.scada.iec104:

tshark -i <iface> -Y "104asdu" -O 104asdu

Record every open port 2404, the ASDU/common address and information-object addresses you enumerate, and the exact interrogation or command frames you sent and their observed effect, so the evidence and the safety context land in the pentest report rather than a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

The most important thing to understand about port 2404 is that IEC-104’s defining weakness is not a CVE — it is the protocol design. There is no missing patch that adds authentication or encryption to the base standard; commanding an RTU over an open, unauthenticated 2404 session is expected, conformant behavior, not a bug. The fix for that is architectural (segmentation, IEC 62351/TLS, allowlisting) and is covered under Mitigation — you will not find, and should not cite, a CVE for “IEC-104 has no auth.”

The real CVEs on this port live in specific implementations — the stacks and RTU firmware that parse IEC-104 frames — and they are overwhelmingly robustness/denial-of-service issues rather than authentication bypasses. Three verified, genuinely-IEC-104 examples:

• CVE-2026-16002 — MZ Automation lib60870 (through 2.4.0), the widely embedded open-source IEC 60870-5-101/104 library. Insufficient length validation when decoding an ASDU information object (Type ID 41, S_IT_TC_1) lets a crafted frame trigger an out-of-bounds heap read and crash the parser — an unauthenticated, network-reachable denial of service against any CS101 master or CS104 client built on the library. CVSS 3.1 8.2 (fixed in lib60870 2.4.1).
• CVE-2026-1773 — Hitachi Energy RTU500 series telecontrol units. A malformed IEC 60870-5-104 U-format frame can cause a denial of service; the device is affected only when IEC-104 bi-directional functionality is configured. Unauthenticated and network-reachable, CVSS 3.1 7.5 / CVSS 4.0 8.7 (High). Notably, enabling IEC 62351-3 secure communication reduces exploitation risk but does not remediate the flaw itself.
• CVE-2021-21778 — MZ Automation lib60870.NET 2.2.0. A specially crafted request in the ASDU message-processing path leads to an unhandled exception and loss of communications — an unauthenticated network DoS against the .NET IEC-104 stack. CVSS 3.1 7.5 (High).

The pattern is deliberate: fingerprint the exact RTU, gateway, or library and version on port 2404, then check that product against NVD (Siemens, ABB/Hitachi Energy, Schneider, GE, and the lib60870 family all have their own advisories). And attribute famous ICS incidents accurately — the IEC-104 attacks below used IEC 60870-5-104, not Modbus, and Stuxnet targeted Siemens S7/Step 7, not any telecontrol protocol. No fabricated or wrong-service CVEs are listed on this page.

Mitigation

Because the core risk is design-level, the fixes are network-architectural, not patch-level:

• Never expose port 2404 to the internet or to IT networks. Audit with Shodan/Censys and firewall rules; an IEC-104 station answering a routable address outside the control network is an incident waiting to happen.
• Segment the OT network (Purdue model). Keep RTUs and telecontrol gateways inside the substation/process cell behind an OT DMZ, isolated from corporate IT and remote-access paths. IEC-104 assumes a private, trusted WAN — give it one.
• Allowlist the control center. Restrict who can open a TCP session to 2404 to the specific SCADA front-end/master IPs that legitimately poll each station, and drop everything else at an OT-aware firewall.
• Deploy IEC 62351. Where equipment supports it, wrap IEC-104 in TLS with mutual authentication (IEC 62351-3/-5) to add the encryption and identity the base protocol lacks — or tunnel it over a VPN/IPsec if the RTU can’t do 62351 natively.
• Use data diodes / unidirectional gateways for telemetry that only needs to flow outward to historians or monitoring, so no inbound command path exists at all.
• Patch RTU firmware and IEC-104 libraries for the implementation CVEs above even though the protocol itself won’t change, and disable unused command types and services on the controller.
• Monitor with a protocol-aware IDS. Alert on STARTDT from unexpected sources, unexpected control ASDUs (types 45–51), new common addresses, or malformed frames — the same signals a live attacker would generate.

Real-World Example

IEC-104 is one of the very few OT protocols with a confirmed, nation-state history of being used to physically manipulate a power grid. In December 2016, malware later named Industroyer (ESET) / CRASHOVERRIDE (Dragos) — attributed to the Sandworm group — was used to cut power in Kyiv, Ukraine, taking a transmission substation offline. Industroyer was modular, with separate payload components speaking IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OPC DA. The IEC-104 module connected to the station’s RTUs on port 2404, enumerated their controllable points, and issued control ASDUs to change breaker and switch states — abusing the protocol exactly as designed, with no exploit required, because reaching 2404 was all the authorization it needed.

In April 2022, ESET and CERT-UA reported Industroyer2, a variant used against a Ukrainian energy provider’s high-voltage substations. Unlike the modular original, Industroyer2 was IEC-104-specific — a single executable with the target station’s connection parameters and command sequence hardcoded, built to open breakers at the targeted substations directly over 2404. Together the two incidents are the clearest possible illustration of the port 2404 lesson: the danger isn’t a patchable bug, it’s that an open, unauthenticated IEC-104 channel is control of the grid, and defense has to keep untrusted parties off it. (Contrast this with Modbus on port 502, the same no-auth-by-design story on the plant floor rather than the grid.)

FAQ

What is port 2404 used for?

Port 2404 is the default TCP port for IEC 60870-5-104 (IEC-104), the telecontrol protocol that connects electric-power SCADA control centers to substation RTUs and gateways. It carries the actual telemetry (breaker positions, measured values) and control commands that operate transmission and distribution equipment, and it’s the networked, TCP/IP form of the older serial IEC 60870-5-101 standard.

Does IEC-104 have authentication or encryption?

Not in the base standard. IEC 60870-5-104 has no user, password, session, or encryption of any kind — anyone who can reach port 2404 and send STARTDT can interrogate the station and issue commands. Security is provided separately by the IEC 62351 series (TLS plus authentication in 62351-3/-5), which must be explicitly deployed and, in practice, often isn’t.

Is port 2404 dangerous to expose?

Extremely, on any untrusted network. Because there’s no authentication, an internet- or IT-reachable port 2404 lets an attacker read the substation’s full point list and send control ASDUs to operate breakers and switches, with real, potentially safety-relevant consequences. It should be treated as a critical exposure to close and segment, not a service to harden in place.

Can an attacker really operate grid equipment over IEC-104?

Yes — that’s the protocol’s purpose. Control ASDUs such as single command (C_SC_NA_1, type 45) and double command (C_DC_NA_1, type 46) instruct the RTU to change the state of breakers and switches; other command types adjust setpoints and regulating steps. The Industroyer/CRASHOVERRIDE (2016) and Industroyer2 (2022) attacks against the Ukrainian grid did exactly this over port 2404, using the protocol as designed.

Are the IEC-104 CVEs the main risk?

No. The known IEC-104 CVEs — for example CVE-2026-16002 and CVE-2021-21778 in the lib60870 family, or CVE-2026-1773 in Hitachi Energy RTU500 — are mostly denial-of-service/robustness bugs in specific implementations. The defining risk is the base standard’s lack of authentication and encryption, which is a design characteristic to mitigate with network architecture, not a patch.

How do I secure port 2404?

Keep it off the internet and off IT networks entirely, segment OT using the Purdue model, and allowlist only the specific SCADA masters that need to reach each station. Deploy IEC 62351 (TLS with mutual authentication) or a VPN where the equipment supports it, use unidirectional gateways for outbound-only telemetry, patch RTU firmware and IEC-104 libraries for implementation CVEs, and monitor for unexpected STARTDT sessions and control ASDUs.

TL;DR

• Service: IEC 60870-5-104 (IEC-104) — TCP/IP telecontrol between electric-power SCADA control centers and substation RTUs (the networked form of serial IEC 60870-5-101)
• Default port: 2404/TCP (secured with TLS via IEC 62351-3 where deployed)
• Biggest risk: no authentication and no encryption by design — anyone reaching port 2404 can read ASDU telemetry and send control commands (C_SC/C_DC) to operate breakers and switches, as demonstrated by Industroyer (2016) and Industroyer2 (2022)
• Mitigation: never internet/IT-expose; segment (Purdue model); allowlist the control center; deploy IEC 62351/TLS or VPN; use unidirectional gateways; patch RTU firmware and IEC-104 stacks and monitor OT traffic

IEC-104 is one of several device- and infrastructure-control protocols that assume a trusted network they no longer have. For related OT and device-management exposures, see Modbus on port 502 (unauthenticated PLC control on the plant floor), SNMP on port 161 (device management with weak community strings), and Telnet on port 23 (unencrypted legacy device administration). Sibling telecontrol and PLC protocols such as DNP3 on port 20000 and Siemens S7comm on port 102 share the same design-level trust assumptions. Whatever you find on port 2404, capture the common address, information-object addresses, and command evidence directly in your pentest reporting tool.