CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Remote access

Port 23: Telnet

Clear-text remote shell. Still found on routers, IoT devices and industrial equipment.

23

How Telnet works

Remote access
terminal:23password: toor terminal:23password: toor

The client opens a session to port 23: each command typed is sent to the server, which runs it and returns the output. It travels in clear text: anyone on the path can read it, passwords included.

Transport
TCP · UDP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
Remote access
01 Security

Is port 23 dangerous?

Common attacks and weaknesses

  • Credentials and sessions readable on the network.
  • Mirai-style botnets log in with default IoT passwords.
  • Vulnerable embedded telnet daemons.

How to secure it

  • Disable Telnet and use SSH.
  • Change default credentials on devices.
  • Block port 23 at the edge.
02 Registry

IANA registry entries for port 23

ServicePortTransportDescriptionReferenceUpdated
telnet 23 TCP, UDP Telnet RFC 854 -

// source: IANA service name and port number registry

03 Check it

Which program uses port 23, and is it reachable?

Linux

sudo ss -ltnup 'sport = :23'      # process listening on 23
sudo lsof -nP -i :23

macOS

sudo lsof -nP -i :23

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 23 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 23
netstat -ano | findstr :23

From another machine

nmap -p 23 -sV <host>
sudo nmap -sU -p 23 <host>
nc -zv <host> 23

Block it in the firewall

sudo ufw deny 23/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 23" -Direction Inbound -LocalPort 23 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 23 used for?

Clear-text remote shell. Still found on routers, IoT devices and industrial equipment.

Is port 23 TCP or UDP?

Port 23 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 23?

It is rated 9/10 (critical) when exposed to the Internet. Credentials and sessions readable on the network. Disable Telnet and use SSH.

How do I check if port 23 is open?

On Linux run "ss -ltnup 'sport = :23'", on macOS "lsof -nP -i :23", and on Windows "netstat -ano | findstr :23" to see the local process. From another machine, "nmap -p 23 <host>" shows whether it is reachable.

05 Related
:22 SSH tcp · udp · sctp · moderate risk :3389 RDP tcp · udp · critical risk :5900 VNC tcp · udp · critical risk :5985 WinRM (HTTP) tcp · udp · high risk :5986 WinRM (HTTPS) tcp · udp · high risk :10000 Webmin tcp · udp · high risk :89 SU/MIT Telnet Gateway tcp · udp :107 Remote Telnet Service tcp · udp

Latest vulnerability news

All news