Open ports with no services bound to them

Question

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?

Answer 1

...would that be considered a security vulnerability?

No since there is no application behind that port to be exploited. (This port is actually called closed)

Do not mix up an unfiltered port with an open port. A unfiltered port is just a port which has no specific configuration (rule) in a firewall. It can still be either open or closed.

Answer 2

A port is open when a service is listening to it. A service processes data. And that is why open ports are interesting for an attacker in that they expose the vulnerabilities of the services that are listening to (using) them. As long as there is no service listening to a given port we can not talk about open ports and the risks associated to them (by definition).

Answer 3

This actually is a vulnerability, based on your question. An open port on a firewall is a point of entry into a system. Having a service attached doesn't prevent it from not being a vulnerability.

Even if you are referring to a OS firewall, the application of a firewall, and the actually application of software are two separate risk profiles even if they are on the same box.

You can look at the definitions of a Vulnerability from different standards but essentially they are all the same, which is a flaw that could be exploited.

An application that listens on a port won't receive communication on that port if the firewall is configured to block the incoming traffic. Connections locally will succeed but connections occurring outside the system will be prevent. This applies to standalone firewalls as well.

Closed/Open/Filtered/Unfiltered are states a firewall may have. Without creating a lengthy post defining them you can take a look at NMAP basics here.