Hacker News Reader

I must be missing something, but why are all these routers publicly listening on port 5431?

Ports 5431 and 1900 are used for UPnP.

I can’t think of any good reason they should be listening on an external interface, but maybe the port scanning is happening on the inside.

That's the thing, it looks like they are listening externally: https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%.... I tried a couple of those IPs and can reach all of them on 5431.

Yeah, DNS rebinding attacks can allow malicious Javascript running inside the network attack the router from the LAN side.