Skip to content
HackIndex.io

Memcached UDP Exposure Checks

1 min read Created Feb 25, 2026 Last updated Feb 25, 2026

UDP exposure is a security issue even when you do not plan to abuse it. Your goal is to confirm whether UDP is enabled and reachable, then report it with proof.

Detecting memcached UDP exposure

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p ${PORT:-11211} $TARGET_IP

Interpretation:

  • open|filtered is common on UDP. You still need an application-level probe to confirm responses.

Application-level UDP probe

Use a short timeout and a low-noise payload. version is usually enough.

┌──(kali㉿kali)-[~]
└─$ printf "version\r\n" | nc -u -nv -w 2 $TARGET_IP ${PORT:-11211}

If it responds, you will typically see a VERSION ... line.

What to do with a positive hit

  • Report UDP exposure as a high-risk misconfiguration.

  • Confirm whether UDP is expected in this environment. Modern hardening often disables it.

Notes that affect interpretation:

  • Many current packages ship with UDP off by default, but older builds and custom configs may still expose it.

  • Even if UDP is off, document that you validated it.

References