Is port 23 (Telnet) exposed to the internet, and how do I close it?

Why port 23 still shows up

Telnet (RFC 854, 1983) predates modern encrypted remote-access protocols like SSH by over a decade, and many embedded device firmware images never dropped it — it’s cheap to implement and gives manufacturers a working remote-admin console without the overhead of TLS or key-based auth. The protocol itself has no encryption, and on a large share of consumer routers, cameras and NVRs it ships with a default username/password that’s published in the device’s manual or easily found online.

What an exposed port 23 actually risks

If port 23 is reachable from the public internet and the device still uses its factory-default or a weak credential, anyone who finds it gets a full administrative shell — the same access level as the device’s own owner. From there an attacker can read configuration (including other credentials stored on the device), change DNS settings to redirect traffic, or install malware. The 2017 academic analysis of the Mirai botnet documented this pattern at internet scale: Mirai’s core technique was scanning the entire IPv4 address space for port 23, then trying roughly 60 hardcoded default username/password pairs — no exploit, just unchanged defaults — which is how it built a botnet of hundreds of thousands of IoT devices in a matter of days.

How to check your own exposure

Use AdminKit’s what is my IP tool to confirm your current public IP, then AdminKit’s planned open ports check (coming with the AdminKit API) is designed to test whether port 23 and the other commonly-exposed device ports respond from outside your own network, with your consent, only ever against the IP making the request.

How to fix it

• Change the device’s default credentials immediately — this alone defeats the Mirai-style attack even if the port stays open.
• Disable Telnet management entirely if the device offers SSH or an HTTPS admin panel instead; most modern router and camera firmware has a setting to turn Telnet off.
• Remove any port-forwarding rule or UPnP mapping that exposes port 23 to the internet — legitimate remote administration should go through a VPN or the vendor’s cloud dashboard, not a raw Telnet port forwarded to the world.
• Re-run open ports check afterward to confirm port 23 is no longer reachable from outside.

For the full walkthrough — including RTSP (port 554), which shows up on the same camera and router hardware for a related reason — see our guide on Telnet and RTSP camera/router exposure.

Defensive use only

Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.