Security group blocks Internet ingress to Telnet port 23

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups are evaluated for rules that allow inbound Telnet on TCP 23 from the Internet (0.0.0.0/0 or ::/0).

Risk

Public Telnet exposes cleartext credentials and remote shell access.

Brute-force and credential interception enable account takeover
Command execution enables data theft and lateral movement

This threatens confidentiality and integrity and can degrade availability through misuse.

Recommendation

Remove rules permitting Internet access to TCP 23 from 0.0.0.0/0 or ::/0. Disable Telnet on hosts. Prefer SSH or SSM and apply least privilege network rules. Restrict admin access to trusted IPs, VPN, or private endpoints, and use defense in depth with NACLs and logging.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":23,"ToPort":23,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 23
    to_port     = 23
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # CRITICAL: Restricts Telnet (23); do not use 0.0.0.0/0 or ::/0
  }
}

# CloudFormation: restrict Telnet (port 23) from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Telnet
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 23
          ToPort: 23
          CidrIp: 10.0.0.0/8  # CRITICAL: Restricts Telnet (23) to internal range; removes Internet-wide (0.0.0.0/0) access

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires