TCP 2375 is the default non-TLS port commonly associated with the Docker remote API. When Docker’s daemon listens on this port, management requests may be sent in cleartext and, if access controls are weak, without strong authentication.
In cyber security, this matters because the Docker API can create containers, mount filesystems, change networking, and control the host environment. An exposed 2375 listener can therefore turn a container platform into a remote administration point for attackers. Threat actors often scan for this port, then use it to deploy payloads, establish persistence, or pivot into the underlying server. Defenders should treat 2375 as high risk: avoid exposing it to untrusted networks, prefer TLS-protected access on 2376 or better, restrict source IPs, and monitor for unexpected daemon activity, container creation, or configuration changes.