The default MongoDB port, where the database listens for client connections. Modern versions bind to localhost out of the box, which was not always true and is the reason for a long history of exposed instances.
Older versions bound to all interfaces with no authentication, which led to tens of thousands of databases being wiped and held to ransom. Modern versions default to localhost — keep it that way.
Close it and verify authentication is enabled. Exposed MongoDB instances have historically been wiped and ransomed en masse by automated scripts, so check your collections are intact before assuming you caught it in time.
The port scanner will tell you whether 27017 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.