Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP port 23 (Telnet)

ec2_instance_port_telnet_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances with security groups allowing inbound Telnet on TCP 23 from the Internet are identified, including open IPv4/IPv6 sources like 0.0.0.0/0 and ::/0.

Exposure is evaluated considering public IP assignment and subnet reachability.

Prowler logoProwlerprowler-provider-aws

Risk

Exposed Telnet weakens confidentiality and integrity: credentials and commands are plaintext, enabling interception and session hijacking. Attackers can brute-force to gain shell, run remote commands, exfiltrate data, and pivot laterally, also threatening availability through misuse or takeover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_telnet_exposed_to_internet

Recommendation

Eliminate Telnet: disable the service and block TCP 23.

Apply least privilege network access-restrict admin connectivity via SSH through bastion or VPN, keep management paths private, and segregate hosts. Use defense in depth with monitoring and strong authentication for any legacy needs.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 23 --cidr 0.0.0.0/0

Terraform

# Restrict Telnet (port 23) from the Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 23
    to_port     = 23
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: do NOT use 0.0.0.0/0; restrict Telnet to trusted CIDR to fix the finding
  }
}

NativeIaC

# CloudFormation: restrict Telnet (port 23) from the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Telnet access
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 23
          ToPort: 23
          CidrIp: 10.0.0.0/8  # Critical: do NOT use 0.0.0.0/0; restrict Telnet to trusted CIDR to remediate exposure

Other

1In the AWS Console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3Open the Inbound rules tab and find any rule allowing TCP port 23 from 0.0.0.0/0 or ::/0
4Delete the rule, or edit it to a specific trusted CIDR only
5Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_telnet_exposed_to_internet(Check):
    # EC2 Instances with Telnet port 23 open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [23]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have Telnet port 23 open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "Telnet"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References