Port 2407: Orion — The Port Nobody Claimed

What Port 2407 Is

Port 2407 sits in the registered port range (1024–49151). IANA officially assigns it to a service called "Orion" on both TCP and UDP, but documentation about what "Orion" actually is or whether it ever shipped as a real product is essentially nonexistent. In practice, this port is unoccupied by anything widely deployed.

The Navision Connection

The most concrete real-world history of port 2407 belongs to Microsoft Navision (now Dynamics 365 Business Central), a mid-market ERP and accounting platform. Navision used port 2407 as the default port for its classic database service. It was baked in deep enough that administrators trying to run multiple Navision instances on one machine ran into trouble — the service would ignore custom port configurations and fall back to 2407 regardless.

Navision was eventually absorbed into Microsoft's Dynamics product line. The classic client architecture that depended on port 2407 has been largely retired, but it ran for years inside the financial infrastructure of thousands of businesses.

The Vulnerability Worth Knowing

In 2001, a denial-of-service vulnerability was documented in Navision Financials Server 2.60 and earlier: CVE-2001-0392. An attacker could crash the server by sending a null character followed by a long string to port 2407. No authentication required. One connection, one null byte.¹

It was patched. But it's a useful reminder that software binding to any port can become a target, and unmonitored default ports are where these vulnerabilities quietly wait.

What Else Has Used This Port

Security databases note that the Yoyo Trojan historically used port 2407 as a command-and-control channel.² This is typical of the registered range — malware authors pick lightly-used port numbers specifically because they're less likely to be blocked by default firewall rules.

How to Check What's Listening

If port 2407 shows up open on a system you're investigating:

Linux/macOS:

sudo ss -tlnp | grep 2407
sudo lsof -i :2407

Windows:

netstat -ano | findstr :2407

The PID from netstat maps to a process in Task Manager. If nothing you recognize owns this port, treat it with suspicion.

Why Unassigned Ports Matter

The registered range exists so software vendors can reserve a port number for their application, preventing conflicts. But IANA registration is voluntary, enforcement is nonexistent, and many assignments are historical artifacts from software that no longer exists or was never widely deployed.

Port 2407 is a small example of how the port number space actually works in practice: official assignments that nobody uses, unofficial uses that ran for decades, and the occasional vulnerability sitting quietly at a default nobody changed. The port namespace looks orderly on paper. In the wild, it's archaeology.