Weakness (CWE)
CWE-489: Active Debug Code
The product is released with debugging code still enabled or active.
How to prevent it (1 mitigation)
-
Build and Compilation, Distribution
Remove debug code before deploying the application.
Source: MITRE CWE-489
108 results · Feed
-
High 7.2
Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network a…
-
Medium 4.3
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter3…
-
Medium 4.9
A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45.…
-
Medium 6.5
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. …
-
High 8.6
A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Secur…
-
High 8.1
An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota Al…
-
Low 3.0
Contec Health CMS8000
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify add…
-
High 8.3
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.…
-
Critical 9.1
A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted n…
-
Critical 9.9
A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A s…
-
Medium 6.7CVE-2021-3972 Public exploit
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS …
-
Medium 6.7
A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook device…
-
High 7.2
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
-
Critical 10.0
A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-cra…
-
Medium 6.5
Possible Access to Debug Functions in Bosch VRM / BVMS
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and B…
-
Unscored —
An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary…
-
Medium 6.1
Cisco IOS XE Software Active Debug Code Vulnerability
A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with high privileges or an unauthenticated attacker with physical access to the device to open a debugging console. The vulnerability is due to insufficient command authoriz…
-
Medium 5.1
Cisco IOS and IOS XE Software Privilege Escalation Vulnerability
A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root privilege. The vulnerability is due to the presence of development testing and verification scripts tha…
-
Medium 6.8
Cisco IOS XE Software Arbitrary Code Execution Vulnerability
A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affec…
-
Unscored —
Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated re…
-
Unscored —
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab…
-
Medium 6.4
An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.
-
High 8.8
ABB System 800xA Information Manager Remote Code Execution
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arb…
-
Unscored —
A vulnerability has been identified in TIM 3V-IE (incl. SIPLUS NET variants) (All versions < V2.8), TIM 3V-IE Advanced …
-
Unscored —
Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enab…
-
Unscored —
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web…