Port 23 – Telnet (Teletype Network)

Port 23 is the default port for Telnet, the protocol that gives you an interactive shell or command line on a remote host. Everything in a Telnet session — the login prompt, your password, every keystroke, and the server’s replies — travels in cleartext, with no encryption at any point. That’s why an open port 23 is one of the first findings worth chasing on any host: if you can reach it, so can anyone else on the path.

Why It’s Open

Before SSH, Telnet was the standard protocol for remote shell access on UNIX and network gear. It still shows up on legacy servers, network devices (Cisco, HP, Huawei, MikroTik), embedded systems, and a huge number of IoT devices that shipped with it enabled by default. On anything built this decade you should see SSH on port 22 instead — where port 23 is still answering, it usually means old firmware, a forgotten management interface, or a device nobody has touched since it was racked.

Common Risks

• No encryption. Credentials, commands, and output are all transmitted in cleartext — anyone on the path can sniff the session.
• Default or weak credentials. Most IoT compromises via Telnet are just root:root, admin:admin, or vendor defaults. The Mirai botnet scanned the entire IPv4 space for exactly this.
• No rate limiting in most implementations. Makes brute-force trivial.
• Known remote-exploitable bugs in older telnetd daemons (FreeBSD, Solaris, Inetutils).
• Information disclosure via banners. Server banners frequently reveal OS, version, and sometimes device model.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Check if it’s open and grab the banner

nmap -sV -p 23 --script=banner,telnet-encryption,telnet-ntlm-info <target>

Raw banner grab with netcat

nc -nv <target> 23

Interactive connection

telnet <target> 23

Brute-force with Hydra

hydra -L users.txt -P passwords.txt telnet://<target> -t 4 -f

Brute-force with Ncrack

ncrack -p 23 --user root -P /usr/share/wordlists/rockyou.txt <target>

Metasploit modules

msfconsole -q
use auxiliary/scanner/telnet/telnet_version
set RHOSTS <target>
run

use auxiliary/scanner/telnet/telnet_login
set RHOSTS <target>
set USER_FILE users.txt
set PASS_FILE passwords.txt
set STOP_ON_SUCCESS true
run

Capture every open port 23 and every credential that works as you go, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

• CVE-2011-4862 — Stack buffer overflow in encrypt_keyid in the Telnet daemon on FreeBSD, MIT Kerberos, and derivatives. Remote code execution before authentication on vulnerable builds; weaponised in Metasploit as exploit/freebsd/telnet/telnet_encrypt_keyid and archived on Exploit-DB.
• CVE-2020-10188 — Buffer overflow in utility.c in GNU Inetutils telnetd through 1.9.4. Remote attackers can execute arbitrary code via short writes or urgent data.
• CVE-2022-39028 — GNU Inetutils telnetd denial-of-service via crafted option negotiation.

Mitigation

• Replace with SSH. There is almost never a legitimate reason to run Telnet on a modern network — move management to SSH on port 22, which encrypts the whole session.
• Disable telnetd entirely if the device supports an alternative management plane.
• Firewall TCP/23 to management networks only.
• Force change of all default credentials on any device where Telnet must remain enabled.
• Monitor for Mirai-style scanning of port 23 on any exposed subnet.

Real-World Example

The Mirai botnet compromised hundreds of thousands of IoT devices in 2016 by scanning the IPv4 space for port 23 and trying a list of ~60 common default credentials. The resulting DDoS attacks took down Dyn, Krebs on Security, and OVH. Telnet with default creds remains the single most effective IoT compromise vector a decade later.

FAQ

What is port 23 used for?

Port 23 is the default Telnet port. It carries interactive remote-shell and terminal sessions to servers, routers, switches, and embedded devices — historically the main way to administer a box before SSH existed. Everything in the session is unencrypted.

Is port 23 dangerous?

Yes, on any untrusted network. Telnet has no encryption, so credentials and commands can be read straight off the wire, and exposed devices are constantly scanned for default logins. Treat an internet-facing port 23 as something to close or replace, not to harden in place.

What service runs on port 23?

Telnet (via a telnetd daemon). It’s still the default on plenty of legacy network hardware and IoT firmware, even though SSH on port 22 has replaced it for secure remote access.

How do I close port 23?

Disable or uninstall the Telnet daemon, switch management to SSH, and firewall TCP/23 so nothing outside a trusted management range can reach it. After the change, rescan with nmap -p 23 <target> to confirm the port is closed.

TL;DR

• Service: Telnet (remote login)
• Default port: 23/TCP
• Biggest risk: cleartext credentials + default passwords
• Mitigation: disable, replace with SSH, firewall to management networks