{
  "port": 23,
  "protocol": "tcp",
  "service": "Telnet",
  "oneLiner": "Telnet — unencrypted remote shell, superseded by SSH decades ago.",
  "whatItIs": "Telnet gives a raw bidirectional character stream to a login process, with in-band option negotiation for things like terminal type and echo. There is no encryption and no server authentication, so credentials and session content are readable by anyone on the path. It still shows up on switches, PDUs, serial console servers, and embedded devices, and the `telnet` client itself survives as a generic TCP poking tool. Finding 23 open on a scan is normally an unpatched appliance rather than a deliberate choice.",
  "exposure": {
    "verdict": "never",
    "note": "Cleartext credentials with no server authentication; there is no configuration that makes an internet-facing telnet server acceptable."
  },
  "checkCommand": "sudo lsof -nP -iTCP:23 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 854 — Telnet Protocol Specification",
      "url": "https://www.rfc-editor.org/rfc/rfc854.html",
      "kind": "spec"
    },
    {
      "title": "GNU Inetutils (telnet client and server)",
      "url": "https://www.gnu.org/software/inetutils/",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}