TCP port 23 is the standard network port used by Telnet, a legacy remote-access protocol that transmits usernames, passwords, and commands in plaintext. Because Telnet offers no encryption or strong built-in security, it is considered high-risk on exposed systems and is often disabled in modern environments.
In cyber security, port 23 is a useful indicator of scanning and brute-force activity. Attackers and botnets frequently probe it to find devices or servers that still accept Telnet connections, then try weak credentials or use the service as a foothold for further compromise. Defenders watch for repeated connection attempts, unusual source patterns, and small bursts of traffic to 23/TCP, since these often signal reconnaissance rather than normal administration. Blocking Telnet, segmenting management access, and using SSH or other encrypted alternatives are common defensive measures.