ZoomEye finds 973,278 hosts exposing syslog on port 514
A ZoomEye query for port 514 returned 973,278 reachable syslog assets as of October 3, 2026. Because syslog has no built-in authentication or encryption, exposed collectors accept forged messages and allow log injection.
- ZoomEye query for port=514 returned 973,278 matches on October 3, 2026
- Syslog defaults to unauthenticated, unencrypted UDP transport
- RFC 5425 defines syslog over TLS on port 6514 for origin validation
- Risks include message injection, log forging and data redirection
Read next
Security