Weakness (CWE)
CWE-489: Active Debug Code
The product is released with debugging code still enabled or active.
How to prevent it (1 mitigation)
-
Build and Compilation, Distribution
Remove debug code before deploying the application.
Source: MITRE CWE-489
38 results · Clear filters · Feed
-
High 8.8
Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authent…
-
High 8.1
AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execu…
-
High 7.1
Postgres-exporter: net/http/pprof exposed on metrics listener
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information discl…
-
High 8.9
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP…
-
High 8.2
Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation of job dispatch (dos)
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in produ…
-
High 8.2
UEFI BIOS embedded Shell can be used to bypass Secure Boot
UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.
-
High 8.8
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to t…
-
High 7.5
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log informati…
-
High 7.0CVE-2026-65893 Public exploit
Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera
This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution throu…
-
High 7.8
crypto: qat - remove unused character device and IOCTLs
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration…
-
High 8.8
Allwinner TV Box TV98 ADB exposed on network
Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.
-
High 7.7
JuiceFS - Authentication Bypass via pprof and metrics Endpoints
JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.Default…
-
High 8.7
Elevated Root Command Execution via ai_cmd Sockets
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
-
High 7.5
Algernon: Single-file mode unconditionally enables debug mode
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whi…
-
High 7.7
Arbitrary file read in rabbitmq-aws plugin
Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file…
-
High 7.0
A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attac…
-
High 8.0
Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an atta…
-
High 7.9
Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escal…
-
High 7.3
A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentio…
-
High 8.9
WatchGuard Firebox leftover debug code vulnerability
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.
-
High 8.4
There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to p…
-
High 8.1CVE-2022-20649 EPSS 12%
Cisco Redundancy Configuration Manager Debug Remote Code Execution Vulnerability
A vulnerability in Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container. This vulnerability…
-
High 7.8
There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could l…
-
High 7.2
FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vuln…
-
High 7.2
Leftover debug code exists in the boa formSysCmd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A…
-
High 7.5
Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitra…
-
High 7.2
A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Ro…
-
High 8.8
Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-a…
-
High 8.3
Debug feature in Sensormatic Electronics Illustra Dome and PTZ cameras
A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.
-
High 7.5
Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to i…
-
High 7.5
Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-series
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized…
-
High 7.2
A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-…
-
High 7.2
Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network a…
-
High 8.6
A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Secur…
-
High 8.1
An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota Al…
-
High 8.3
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.…
-
High 7.2
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
-
High 8.8
ABB System 800xA Information Manager Remote Code Execution
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arb…