Port :23Telnet

Common Vulnerabilities

• Lack of encryption: All credentials and data are transmitted in plaintext, making it trivial for attackers employing packet sniffing or Man-in-the-Middle (MitM) techniques to capture sensitive information.
• Credential interception: Attackers can harvest usernames and passwords, enabling unauthorized network access.
• Susceptibility to replay attacks: Without cryptographic protections, session data can be captured and replayed by attackers.
• Exploitation of server bugs: Older or poorly maintained Telnet implementations may contain buffer overflows and other software vulnerabilities.

Common Mitigations

• Disable Telnet: The preferred mitigation is to completely disable Telnet services where possible.
• Replace with SSH: Employ Secure Shell (SSH) as it provides encrypted communication and stronger authentication methods (keys, certificates).
• Restrict access: Limit exposure by filtering traffic to port 23 using firewalls or access control lists, only allowing trusted administration hosts.
• Use VPNs: If Telnet use is unavoidable over insecure networks, tunnel the session inside an encrypted VPN.
• Monitor and audit: Enable logging, and monitor connection attempts to detect unauthorized access.
• Use strong credentials: Enforce strong, frequently updated passwords to mitigate brute-force attacks.

Recent

• CVE-2026-24061 (CVSS 9.8): GNU InetUtils telnetd passed a client-supplied USER value of -f root to login, which then skipped authentication, giving a root shell with no password. Exploitation began 2026-01-21, and CISA added it to its Known Exploited Vulnerabilities catalog. Update telnetd, or better, remove it.
• Botnets: Mirai and its successors scan TCP 23 and 2323 for devices still using default credentials.