Is it safe to have Telnet port 23 open to the internet?

No. Telnet sends usernames, passwords and everything typed without encryption, and bots constantly try default passwords on it. The Mirai botnet took over hundreds of thousands of cameras, video recorders and routers this way. Turn Telnet off and use SSH or the device's web interface instead.

What is the difference between Telnet and SSH?

Both give you a remote command line on a device. Telnet sends everything, including the password, as plain text. SSH encrypts the whole session. SSH replaced Telnet decades ago and is the safe choice.

What if my device can't turn Telnet off?

Remove any router rule that exposes it to the internet, change its default password, put it on a separate network segment, and check for a firmware update. If none of that is possible, plan to replace the device.

High risk Port 23 · Telnet remote login

Telnet port 23 is open: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 5 minute read

Short answer: port 23 is Telnet, a 1960s-era way of logging in to a device's command line. It sends the username, password and everything you type without encryption, and bots try default passwords on it all day. It's how the Mirai botnet took over cameras, video recorders and routers by the hundreds of thousands.

The fix: turn Telnet off on the device, remove any router rule that exposes it, and change the device's default password. Use SSH or the device's web page for management instead.

What is port 23?

Telnet is one of the oldest internet protocols. It gives a remote text console on a device, much like SSH, but with no encryption at all. Almost no one sets it up on purpose today. It's usually left switched on in equipment like:

Security cameras and video recorders (DVRs and NVRs), especially low-cost models.
Routers, modems and network switches, including some supplied by internet providers.
Printers, UPS battery units, building controls and other devices with a network card.
Old servers and industrial equipment that predate SSH.

It becomes reachable from the internet through a router port forward, a device put in the router's DMZ, or a device connected directly to the internet with a public IP address.

Why an open port 23 is high risk

No encryption. Anyone who can see the traffic can read the login and every command.
Default passwords. Many devices ship with logins like admin/admin or root/12345, and these lists are public.
Botnets hunt for it. In 2016, the Mirai malware scanned the internet for open Telnet, logged in with about 60 common default passwords, and turned the devices into a botnet. It was used for some of the largest attacks seen at the time, including one that knocked major websites offline for much of the US East Coast. Mirai's descendants still scan for Telnet today.
A foothold inside your network. A hijacked camera or router sits inside your network, where attackers can watch traffic or attack other devices.

How it looks in your report your-office-ip

23 Telnet Transmits credentials in plaintext High

Any High finding caps your exposure grade at D

How to confirm it and find the device

Check from outside your network. A free FreshScanSentry Basic Scan of your public IP address shows whether port 23 answers and often what kind of device it is.
Or use Nmap from another connection, such as a phone hotspot:
```
nmap -p 23,2323 -sV your-public-ip
```
The service line often names the device type or brand. Port 2323 is a common alternative Telnet port that Mirai also tried.
Find the device. In your router, look for a port forward for 23 (or 2323) and note the inside IP address it points to, or check whether a device is in the DMZ. The router's list of connected devices shows which device has that address.

Only scan addresses you own or have written permission to test.

How to fix it

1. Remove the internet exposure

Delete the router's port forward for 23 (and 2323), and turn off DMZ mode if a device is in it. This stops attacks from the internet straight away.

2. Turn Telnet off on the device

Cameras, recorders, printers and similar devices: log in to the device's web page and look under Network, Services, Security or Advanced for Telnet, and turn it off. Turn on SSH instead if you need command-line access.
Routers: look under Administration or Remote management. Turn off Telnet and any "remote management from WAN" option you don't need. For a router your internet provider supplied, ask the provider to disable Telnet.
Cisco and similar switches: allow only SSH on the management lines:
```
line vty 0 15
 transport input ssh
```

Linux servers: remove the Telnet server and use SSH:

# Debian / Ubuntu
sudo apt remove telnetd inetutils-telnetd

# Red Hat family
sudo systemctl disable --now telnet.socket
sudo dnf remove telnet-server

3. Change default passwords and update firmware

Give every device a unique, strong admin password. This is the step that would have stopped Mirai.
Install the latest firmware from the manufacturer's website. Newer firmware often turns Telnet off by default.

4. If Telnet can't be turned off

Some cheap or old devices have Telnet built in with no off switch. Keep them off the internet, put them on a separate network (a guest Wi-Fi or a VLAN) away from your computers, and plan to replace them. A device you can't secure doesn't belong on a business network.

5. Re-scan to confirm

Run another external scan. Port 23 should no longer appear, and your exposure grade should go up.

If you think a device was already hijacked

Signs include a device running slowly or hot, your internet connection slowing down, unexpected settings changes, or a warning from your internet provider about attack traffic from your connection. Disconnect the device, reset it to factory settings, update its firmware, set a new strong password, and turn Telnet off before reconnecting. Restarting alone isn't enough. Mirai-style malware is often wiped by a reboot, but the device gets reinfected within minutes if Telnet is still open with the same password.

Common questions

Is the Telnet program on my computer a problem?

No. The Telnet client, the program you use to connect to something, isn't a risk. The finding means a device on your network is running a Telnet server that accepts logins.

Our device has a strong password. Is Telnet OK then?

It's much better than a default password, but Telnet still sends that password unencrypted every time someone logs in, and old Telnet servers have their own bugs. Turn it off and use SSH.

Why does a camera even have Telnet?

Manufacturers often leave it on for factory testing or support. It's rarely needed by the owner.

Sources: CISA: Heightened DDoS threat posed by Mirai and other botnets · CISA: Securing the Internet of Things · RFC 854 (Telnet) · Nmap service and version detection