Unencrypted Telnet Server

medium Nessus Plugin ID 42263

Language:

Synopsis

The remote Telnet server transmits traffic in cleartext.

Description

The remote host is running a Telnet server over an unencrypted channel.

Using Telnet over an unencrypted channel is not recommended as logins, passwords, and commands are transferred in cleartext. This allows a remote, man-in-the-middle attacker to eavesdrop on a Telnet session to obtain credentials or other sensitive information and to modify traffic exchanged between a client and server.

SSH is preferred over Telnet since it protects credentials from eavesdropping and can tunnel additional data streams such as an X11 session.

Solution

Disable the Telnet service and use SSH instead.

Plugin Details

Severity: Medium

ID: 42263

File Name: telnet_clear_text.nasl

Version: 1.15

Type: remote

Family: Misc.

Published: 10/27/2009

Updated: 1/16/2024

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Information disclosure vulnerability.

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: manual

CVSS v3