Check Point Advisories

Non-Telnet Traffic Over Port 23

Vulnerability
Protection

Check Point Reference:	CPAI-2012-075
Date Published:	27 Feb 2012
Severity:	High
Last Updated:	Sunday 23 February, 2025
Source:
Protection Provided by:	Security Gateway R75 R71 R70
Who is Vulnerable?	Computer networks
Vulnerability Description	TCP Port 23 is normally used to transfer Telnet traffic. Non-Telnet traffic over this port may be used for malicious purposes.
Vulnerability Details	Many applications scan for open Telnet ports for malicious purposes. Non-Telnet traffic over port 23 may indicate an attempt to pass malicious traffic to or outside the network.

Protection Overview

This protection will detect and block non-Telnet traffic over port 23.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Non-Telnet Traffic Over Port 23 protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: Telnet Enforcement Violation
Attack Information: Non-Telnet traffic over port 23