What Is Port 23 (Telnet)? Security Risks and How to Close It

Port 23 is the default TCP port for Telnet, a remote-login protocol from the early days of the internet. Telnet sends everything, including usernames and passwords, in plain text, so anyone who can see the traffic can read it. Close port 23 unless a legacy device truly needs it, and use SSH on port 22 instead.

Key takeaways

• Port 23 is the standard TCP port for Telnet, which was specified in RFC 854 in 1983.
• Telnet has no encryption, so credentials and commands can be read by anyone who captures the traffic.
• Open Telnet ports on the internet are a common attack target. The Mirai botnet in 2016 spread by guessing default Telnet passwords on IoT devices.
• You can check whether port 23 is open with Test-NetConnection, nc or Nmap, but only on networks you own or manage.
• The safe fix is to switch to SSH, block TCP 23 at the firewall and isolate any legacy device that cannot be upgraded.

What is port 23 used for?

Port 23 is used for Telnet, a text-based protocol that lets you log in to a remote computer or network device and run commands as if you were sitting at its console. The Telnet client connects to TCP port 23 on the target, and the server answers with a login prompt. Telnet was widely used to manage servers, routers and switches before SSH became the standard.

Today you mostly see port 23 on very old network gear, embedded devices, some industrial controllers and cheap IoT hardware. Many of these ship with Telnet turned on by default, which is why it keeps showing up in security scans.

Why is port 23 a security risk?

Port 23 is a security risk because Telnet sends all data unencrypted and does not verify the identity of the server. Three problems follow from that design:

• Sniffing. Anyone on the same network path, such as a rogue hotspot like the one described in our Wi-Fi Pineapple guide, can capture usernames, passwords and commands.
• Weak and default credentials. Telnet-enabled devices often keep factory logins. The Mirai botnet, which appeared in 2016, scanned the internet for open Telnet ports, tried a short list of default passwords and used the infected cameras and routers for large DDoS attacks.
• Session hijacking and tampering. Without encryption or integrity checks, an attacker in the path can read or alter the session.

A Telnet port exposed to the internet is also a favorite for brute-force attempts. It fits into the wider picture covered in our overview of the top cybersecurity threats in 2026.

Telnet vs SSH: what is the difference?

Telnet and SSH both give you remote command-line access, but SSH encrypts the whole session and authenticates the server, while Telnet does neither. The table compares the two.

How do you check if port 23 is open?

You can check whether port 23 is open by trying to connect to it or by scanning the host. Only test devices and networks you own or have written permission to test. Common commands:

• Windows (PowerShell): Test-NetConnection -ComputerName 192.168.1.1 -Port 23. A result of TcpTestSucceeded : True means the port is open.
• Linux or macOS: nc -zv 192.168.1.1 23 reports whether the connection succeeds.
• Nmap: nmap -p 23 192.168.1.0/24 scans a whole subnet and lists hosts with port 23 open.
• On the device itself: netstat -ano on Windows or sudo ss -tlnp on Linux shows which process is listening on port 23.

Host-based protection can also alert you when new listening ports appear, as described in our guides to HIPS and WIPS.

How do you close or secure port 23?

To close port 23, find every device with Telnet enabled, move management to SSH, turn Telnet off and block TCP 23 at the firewall. If a device cannot be upgraded, isolate it. The flow below shows the decision.

1. Find Telnet. Scan your networks for open port 23 and list every device that answers.
2. Switch to SSH. On most routers and switches you can enable SSH and disable Telnet in the same place. On Cisco IOS, for example, use transport input ssh under the line vty settings.
3. Turn Telnet off. Disable the Telnet service or daemon on servers and IoT devices. On Windows, turn off the optional Telnet Client feature if you do not need it.
4. Block TCP 23. Deny inbound TCP 23 at the internet edge and between network segments. On a home router, make sure remote management and Telnet are disabled.
5. Isolate legacy devices. If a device only supports Telnet, place it in a management VLAN, allow access only from a jump host or VPN and log every login.
6. Fix credentials and firmware. Change default passwords and install firmware updates. Adding two-factor authentication on remote admin accounts also helps.
7. Scan again. Repeat the scan to confirm that port 23 is closed.

Is it ever safe to use Telnet?

Telnet is only acceptable inside an isolated lab or management network where you cannot upgrade a device to SSH and you control every path to it. Even then, restrict access with an ACL and monitor it. For simply testing whether a port is open, use Test-NetConnection or nc instead of the Telnet client. If you are protecting a home network, our guide on how to protect your Wi-Fi from hackers covers the router settings to check.

Frequently asked questions

Is port 23 TCP or UDP?

Port 23 uses TCP. Telnet needs a reliable, ordered connection, so it runs over TCP rather than UDP.

What is the difference between port 22 and port 23?

Port 22 is the default for SSH and port 23 is the default for Telnet. Both give remote command-line access, but SSH encrypts the session and Telnet sends everything in plain text.

Should I block port 23 on my router?

Yes. Block inbound TCP 23 from the internet and turn off Telnet management on the router unless you have a specific, controlled need. Use SSH or the web interface over HTTPS for administration instead.

Why is port 23 open on my device?

Port 23 is usually open because Telnet is enabled by default, an admin turned it on for remote management, or the device is old IoT or network hardware. Check the device settings, disable Telnet and update the firmware.

Can hackers exploit port 23?

Yes. Attackers can sniff Telnet traffic, guess default or weak passwords and take control of the device. The Mirai botnet is a well-known example of attackers abusing open Telnet ports on IoT devices.

Conclusion

Port 23 belongs to Telnet, a protocol that has no encryption and should not face the internet. Scan for it, replace it with SSH, block TCP 23 at your firewalls and isolate any legacy device that cannot change. Regular scans and basic monitoring will catch it if it comes back, and our guide to a virtual CISO shows how smaller teams can own that process.