CAPEC-121
Exploit Non-Production Interfaces
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.
On this page
Non-production interfaces are insecure by default and should not be resident on production systems, since they may reveal sensitive information or functionality that should not be known to end-users. However, such interfaces may be unintentionally left enabled on a production system due to configuration errors, supply chain mismanagement, or other pre-deployment activities.
Ultimately, failure to properly disable non-production interfaces, in a production environment, may expose a great deal of diagnostic information or functionality to an adversary, which can be utilized to further refine their attack. Moreover, many non-production interfaces do not have adequate security controls or may not have undergone rigorous testing since they were not intended for use in production environments. As such, they may contain many flaws and vulnerabilities that could allow an adversary to severely disrupt a target.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-121: Exploit Non-Production Interfaces: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/121.html and https://cve.bz/cve/capec/121?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Determine Vulnerable Interface] An adversary explores a target system for sample or test interfaces that have not been disabled by a system administrator and which may be exploitable by the adversary.
1 technique
- If needed, the adversary explores an organization's network to determine if any specific systems of interest exist.
Exploit
They carry out the attack.
[Leverage Test Interface to Execute Attacks] Once an adversary has discovered a system with a non-production interface, the interface is leveraged to exploit the system and/or conduct various attacks.
1 technique
- The adversary can leverage the sample or test interface to conduct several types of attacks such as Adversary-in-the-Middle attacks (CAPEC-94), keylogging, Cross Site Scripting (XSS), hardware manipulation attacks, and more.
Prerequisites
The target must have configured non-production interfaces and failed to secure or remove them when brought into a production environment.
Skills required
- High skill
Exploiting non-production interfaces requires significant skill and knowledge about the potential non-production interfaces left enabled in production.
Resources required
For some interfaces, the adversary will need that appropriate client application or hardware that interfaces with the interface. Other non-production interfaces can be executed using simple tools, such as web browsers or console windows. In some cases, an adversary may need to be able to authenticate to the target before it can access the vulnerable interface.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges, Bypass Protection Mechanism | Confidentiality, Access Control, Authentication | |
| Read Data, Execute Unauthorized Commands | Confidentiality, Access Control, Authorization | |
| Modify Data, Alter Execution Logic | Access Control, Integrity |
Mitigations
Ensure that production systems do not contain non-production interfaces and that these interfaces are only used in development environments.
Weaknesses it exploits
- CWE-489 Active Debug Code
- CWE-1209 Failure to Disable Reserved Bits
- CWE-1259 Improper Restriction of Security Token Assignment
- CWE-1267 Policy Uses Obsolete Encoding
- CWE-1270 Generation of Incorrect Security Tokens
- CWE-1294 Insecure Security Identifier Mechanism
- CWE-1295 Debug Messages Revealing Unnecessary Information
- CWE-1296 Incorrect Chaining or Granularity of Debug Components
- CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
- CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime
Recent CVEs with these weaknesses
- 8.8CVE-2026-16716
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token a…
- 8.7CVE-2026-123993
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces…
- 9.8CVE-2026-120637
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by de…
- 6.5CVE-2026-117635
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses…
- 9.2CVE-2026-115727
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug de…
- 5.3CVE-2026-15575
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not…
- 7.1CVE-2026-83550
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows f…
- 9.5CVE-2026-100102
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to com…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-113 Interface Manipulation
- More specific patterns
- CAPEC-661 Root/Jailbreak Detection Evasion via Debugging
Examples
Some software applications include application programming interfaces (APIs) that are intended to allow an ad…
Some software applications include application programming interfaces (APIs) that are intended to allow an administrator to test and refine their domain. These APIs are typically disabled once a system enters a production environment, but may be left in an insecure state due to a configuration error or mismanagement.
Many hardware systems leverage bits typically reserved for future functionality for testing and debugging pur…
Many hardware systems leverage bits typically reserved for future functionality for testing and debugging purposes. If these reserved bits remain enabled in a production environment, it could allow an adversary to induce unwanted/unsupported behavior in the hardware.
MITRE's words, unchanged: CAPEC-121 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.