23
Summary
- // if you see it open
- All data, including credentials and keystrokes, travels in cleartext and is trivially captured on-path. Major IoT/embedded attack surface. The Mirai botnet (2016) spread by probing Telnet on 23 and 2323 and brute-forcing hardcoded default credentials; it peaked at over 600,000 infected IoT devices (USENIX Security 2017). Source leak spawned variants (Satori, Wicked, Sora, Owari, Omni) and Gafgyt/Bashlite and Mozi relatives. Exposed Telnet is a critical finding.
- // common applications
- BusyBox telnetdMicrosoft Telnet
- // analyst note
- An open 23/tcp on the internet is a near-automatic high/critical finding — assume cleartext auth and default-credential exposure. Internally it usually flags legacy gear that should move to SSH.
About port 23/tcp.
Port 23/tcp carries Telnet, a plaintext remote-terminal protocol that is one of the oldest on the internet and, by nmap-services frequency, still one of the most commonly open TCP ports — largely because of legacy network gear and embedded/IoT devices. Telnet provides a bidirectional, text-oriented channel built on the Network Virtual Terminal (NVT) abstraction so any client can interoperate with any server, and it negotiates features (echo, binary mode, window size) through DO/DONT/WILL/WONT option commands with SB/SE subnegotiation. Its defining flaw is that everything — usernames, passwords, keystrokes, output — travels in cleartext, trivially captured by anyone on-path, which is why it is considered obsolete and superseded by SSH on port 22. Telnet is a marquee IoT attack surface: the Mirai botnet (2016) spread by probing Telnet on ports 23 and 2323 and brute-forcing a small hardcoded list of default credentials (root/xc3511, root/vizxv, admin/admin, root/123456, and similar), and at its peak Mirai infected over 600,000 IoT devices per the USENIX Security 2017 retrospective. Mirai's leaked source spawned a long line of variants (Satori, Wicked, Sora, Owari, Omni) and relatives in the Gafgyt/Bashlite and Mozi lineages. For an analyst, an open 23 on the internet is a near-automatic high/critical finding — assume cleartext authentication and default-credential exposure; on internal networks it typically flags legacy equipment that should migrate to SSH.
- IANA assignment
telnet— "Telnet"; reference [RFC854]; assignee/contact Jon Postel; assignment note "Defined TXT keys: u=<username> p=<password>" [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.221265 — one of the very highest open TCP ports [Well-established] — nmap-services file
- Related ports
- 22 (SSH, the secure replacement); 2323 (common alternate Telnet, also Mirai-scanned); 992 (telnets, Telnet over TLS)
Primary use
plaintext remote terminal/login to network devices, legacy Unix hosts, and embedded/IoT systems
Other/unofficial uses
ad-hoc TCP service banner-grabbing/debugging with a telnet client; raw text protocols [Community-reported]
Security implications
cleartext credentials trivially sniffed; major IoT/embedded attack surface; Mirai (2016) brute-forced Telnet 23/2323 with default credentials and peaked at >600,000 devices (USENIX Security 2017); exposed Telnet is a critical finding
Typically seen on
routers/switches and other network gear, IoT/embedded devices, legacy Unix/mainframe hosts
- Analyst note
- An open 23/tcp on the internet is a near-automatic high/critical finding — assume cleartext auth and default-credential exposure. Internally it usually flags legacy gear that should move to SSH.
About port 23/udp.
Port 23/udp is registered with IANA as telnet with the description "Telnet," assignee and contact [Jon_Postel], and reference [RFC854]. The entry is a dual registration: both 23/tcp and 23/udp carry the same service name, assignee, and reference in the IANA Service Name and Transport Protocol Port Number Registry. The catch for an analyst is that RFC 854 (J. Postel and J. Reynolds, May 1983) specifies Telnet exclusively over TCP — it provides a bidirectional, eight-bit-clean text terminal connection between a client and a remote host, and UDP is never referenced in the specification. The 23/udp entry therefore exists as a paired-registration artifact, consistent with the historical IANA practice of assigning a name to both transports for protocols registered before strict transport separation was enforced, not because any UDP Telnet implementation is in use. No software is known to operate on 23/udp: every Telnet client and server in practice — BusyBox telnetd on IoT firmware, Cisco IOS Telnet, classic BSD telnetd — is TCP-only. Internet scanning and botnet activity on port 23 is likewise TCP-based; the canonical example is the Mirai botnet (first observed 2016, variants ongoing), which sends TCP SYN packets to 23/tcp (and 2323/tcp) hunting IoT devices with default Telnet credentials, then brute-forces logins from a built-in list of roughly 62 credential pairs. Telnet's underlying weakness is that it transmits everything, credentials included, in cleartext with no encryption, and the standing recommendation is to replace it with SSH; for 23/udp specifically, any observed traffic is anomalous and most plausibly a scanner probe, a misconfiguration, or malware rather than a legitimate service. So for an analyst, a responsive or busy 23/udp should be treated as an oddity to investigate, with the real Telnet attack surface living on 23/tcp.
- IANA assignment
telnet— "Telnet"; reference[RFC854]; assignee[Jon_Postel], contact[Jon_Postel]; dual-registered 23/tcp + 23/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV)- Range class
- well-known (0–1023)
- Registration date / modification date
- blank in the IANA registry — not published; no date fabricated. RFC 854 is dated May 1983, which is the protocol specification date, not an IANA registration date [Confirmed] — IANA registry, RFC 854
- Prevalence / exposure
- scanning and botnet traffic on port 23 is TCP-based; Mirai scans 23/tcp ~10x more than 2323/tcp; 23/udp does not appear as a meaningful scanning or attack surface in the literature reviewed (Shodan/Censys/Masscan enumerate 23/tcp) [Likely] — NETSCOUT/ASERT, Trend Micro, Extreme Networks
- Related ports
- 23/tcp (the real Telnet surface), 2323/tcp (alternate Telnet, Mirai target), 22/tcp (SSH, the recommended replacement)
Primary use
Telnet remote-terminal protocol — but RFC 854 defines Telnet over TCP only; 23/udp is a paired-registration artifact with no UDP implementation in use [Confirmed for the registration; Likely for the "artifact, no real UDP use" reading] — RFC 854 (May 1983), IANA registry
Common software
none known on 23/udp; all Telnet software (BusyBox telnetd, Cisco IOS Telnet, BSD telnetd) is TCP-only
Security implications
Telnet is cleartext (credential interception, brute-force with default creds — the core Mirai technique); replace with SSH. Any 23/udp traffic is anomalous and likely a probe, misconfiguration, or malware
Typically seen on
legitimate Telnet activity is on 23/tcp; an active 23/udp is an anomaly worth investigating
- Modern relevance
- low — Telnet is a deprecated legacy protocol superseded by SSH, persisting on unpatched embedded/IoT hardware over 23/tcp; 23/udp has no known legitimate modern use [Likely] — CBT Nuggets, Heimdal
- Analyst note
- Treat 23/udp as anomalous. The Telnet attack surface and all known activity live on 23/tcp.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| telnet | TCP | — | 22.13% |
| telnet | UDP | — | 0.62% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.