cve.bz

CWE-489: Active Debug Code

Filter

The product is released with debugging code still enabled or active.

What the weakness is: CWE-489 at MITRE. OWASP Top 10: A02:2025 Security Misconfiguration

Related attack patterns (CAPEC): 2
  • CAPEC-121 Exploit Non-Production Interfaces Likelihood: Low · Severity: High
  • CAPEC-661 Root/Jailbreak Detection Evasion via Debugging Likelihood: Medium · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-489, as MITRE names them. Credits.

Ask an AI about CWE-489

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-489: Active Debug Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/489.html and https://cve.bz/cve/cwe/489?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-120637EPSS 0.2%

    CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by de…

  2. 9.2CVE-2026-115727EPSS 0.7%

    AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug de…

  3. 5.3CVE-2026-15575EPSS 0.2%

    Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not…

  4. 7.1CVE-2026-83550EPSS 0.2%

    A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows f…

  5. 9.5CVE-2026-100102EPSS 0.4%

    Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to com…

  6. 9.2CVE-2026-102628EPSS 0.3%

    The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled excep…

  7. 8.9CVE-2026-13313EPSS 0.7%

    An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root pr…

  8. 9.3CVE-2026-103475EPSS 0.4%

    yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensit…

  9. 5.3CVE-2026-100295EPSS 0.2%

    In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could …

  10. 6.7CVE-2026-73593EPSS 0.09%

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information …

  11. 8.2CVE-2026-84486EPSS 0.7%

    A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and…

  12. 6.1CVE-2026-50228EPSS 0.2%

    An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the produ…

  13. 8.4CVE-2026-81943EPSS 0.2%

    PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable th…

  14. 9.8CVE-2026-53952EPSS 0.6%

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to cr…

  15. 8.2CVE-2026-6485EPSS 0.2%

    UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.

  16. 9.0CVE-2026-77545EPSS 0.4%

    A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or ins…

  17. 8.7CVE-2026-66405EPSS 0.5%

    DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

  18. 8.7CVE-2026-66403EPSS 0.4%

    DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

  19. 6.0CVE-2026-41186EPSS 0.7%

    When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener…

  20. 7.0CVE-2026-65893EPSS 0.2%

    This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering …

  21. 7.8CVE-2026-64529EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status…

  22. 8.6CVE-2026-58378EPSS 0.4%

    Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

  23. 8.4CVE-2026-54799EPSS 0.2%

    A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's sign…

  24. 7.1CVE-2026-54798EPSS 0.4%

    A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application includes a debugging interface that is accessible through HTTP e…

  25. 6.1CVE-2026-58191ExploitEPSS 0.6%

    Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/gu…

  26. 7.0CVE-2026-59092EPSS 0.7%

    JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the…

  27. 8.7CVE-2026-49188EPSS 0.3%

    The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.

  28. 7.5CVE-2026-45728EPSS 0.3%

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the Prett…

  29. 8.3CVE-2026-9133ExploitEPSS 1.1%

    Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to pe…

  30. 9.3CVE-2026-40035EPSS 0.6%

    Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empt…

  31. 6.9CVE-2026-32662EPSS 0.3%

    Development and test API endpoints are present that mirror production functionality.

  32. 7.0CVE-2026-33201EPSS 0.2%

    Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code vulnerability. If this vulnerability is exploited, files or configurations on the affected device may be read or written, or arbitrary files may …

  33. 5.5CVE-2026-27131EPSS 0.3%

    The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could p…

  34. 7.0CVE-2025-15017EPSS 0.3%

    A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user inte…

  35. 6.1CVE-2025-42872EPSS 0.3%

    Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session c…

  36. 3.7CVE-2025-2486EPSS 0.1%

    The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shel…

  37. 8.6CVE-2025-64983EPSS 0.3%

    Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attacker to connect via Telnet and gain access to the device.

  38. 5.5CVE-2025-54660EPSS 0.2%

    An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve…

  39. 8.3CVE-2025-30185EPSS 0.1%

    Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable da…

  40. 7.3CVE-2025-52663EPSS 0.2%

    A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal de…

  41. 8.9CVE-2025-4106EPSS 0.3%

    An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagn…

  42. 8.4CVE-2025-36899EPSS 0.09%

    There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

  43. 5.5CVE-2025-21472EPSS 0.09%

    Information disclosure while capturing logs as eSE debug messages are logged.

  44. 8.6CVE-2025-7705EPSS 0.2%

    : Active Debug Code vulnerability in ABB Switch Actuator 4 DU-83330, ABB Switch actuator, door/light 4 DU -83330-500.This issue affects Switch Actuator 4 DU-83330: All Versions; Switch actuator, door/light 4 DU -83330-500: All Versions.

  45. 4.8CVE-2025-1479EPSS 0.2%

    An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary code.

  46. 9.9CVE-2025-46674EPSS 0.6%

    NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracle.

  47. 7.0CVE-2025-2919EPSS 0.4%

    A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. …

  48. 7.0CVE-2024-53648EPSS 0.3%

    A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions < V9.90), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP…

  49. 9.8CVE-2024-9644EPSS 0.7%

    The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" en…

  50. 9.8CVE-2024-9643ExploitEPSS 3.0%

    The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via craft…