Check provider logo

Security group does not allow ingress from the Internet to TCP port 23 (Telnet)

ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23

Severityhigh
Serviceec2
by Prowler
internet-exposed

EC2 security groups are evaluated for rules that allow inbound Telnet on TCP 23 from the Internet (0.0.0.0/0 or ::/0).

Risk

Public Telnet exposes cleartext credentials and remote shell access.

  • Brute-force and credential interception enable account takeover
  • Command execution enables data theft and lateral movement

This threatens confidentiality and integrity and can degrade availability through misuse.

Run this check with Prowler CLI

prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23

Run in Prowler Cloud

Recommendation

Remove rules permitting Internet access to TCP 23 from 0.0.0.0/0 or ::/0. Disable Telnet on hosts. Prefer SSH or SSM and apply least privilege network rules. Restrict admin access to trusted IPs, VPN, or private endpoints, and use defense in depth with NACLs and logging.

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":23,"ToPort":23,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

Native IaC
Terraform
Other
  1. In the AWS console, go to VPC > Security Groups
  2. Select the affected security group and open Inbound rules
  3. Click Edit inbound rules
  4. Find any rule allowing TCP port 23 (Telnet) from 0.0.0.0/0 or ::/0
  5. Delete the rule or change Source to a specific trusted CIDR
  6. Save rules

Source Code

Resource Type

AwsEc2SecurityGroup

References