Exposed Telnet on the public internet
The short version: A Telnet service exposed to the public internet is a legacy remote-access protocol that transmits credentials in cleartext — so it's both a target for password guessing and a place where anyone in the path can simply read the login as it happens.
What you need to know
There's no CVE here — the weakness is the protocol itself, exposed. Telnet predates the modern internet's security assumptions: it has no encryption, so usernames, passwords, and session contents travel in plaintext. It's usually found today on older network gear and embedded/IoT devices, often with default credentials still in place.
- How they find it — internet-wide scanning flags open Telnet (typically TCP 23) and its banners immediately.
- How they use it — automated credential guessing with default and common username/password pairs, and passive interception of cleartext logins where they can see the traffic.
- What it leads to — access to the device's management interface, which on routers, switches, and IoT gear can mean control of network infrastructure. Cleartext exposure means even legitimate use leaks credentials in transit.
How serious we see it
High. Telnet has a secure, drop-in replacement (SSH) and no good reason to face the public internet. Between cleartext credentials and the default-password reality of the devices that still run it, an internet-facing Telnet service is an exposure to retire, not to monitor. The reassuring part is that the fix is entirely in your hands and doesn't wait on a vendor: disable Telnet, switch to SSH, and close the port.
What to do
- Disable Telnet and use SSH — replace it wherever it still runs; this closes the exposure outright.
- Close port 23 at the perimeter — Telnet should not be reachable from the internet under any circumstances.
- Change default credentials — on any device where Telnet lingers, and restrict management to trusted networks.
- Confirm your exposure first — verify whether any Telnet service is internet-facing today, including on network and IoT devices.
How BreachRisk sees it
BreachRisk discovers exposed Telnet the way an attacker would — by scanning your external footprint for reachable Telnet services and confirming the protocol's responses, then flagging it as a verified exposure. Because Telnet has no business on the public internet, confirming it's reachable is the finding that matters: a forgotten Telnet service on a piece of network gear surfaces as a clear, prioritized item to retire before it's abused.