CWE-489— Active Debug Code
The product is released with debugging code still enabled or active.— MITRE CWE catalog
108 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-489page 3 of 3
- CVE-2026-15575MEDIUMCVSS 5.3EG 5.32026-10-16
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did no…
- CVE-2026-32662MEDIUMCVSS 5.3EG 5.32026-04-03
Development and test API endpoints are present that mirror production functionality.
- CVE-2025-1479MEDIUMCVSS 5.3EG 5.32025-05-30
An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary code.
- CVE-2021-1391MEDIUMCVSS 5.1EG 5.12021-03-24
A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root privilege. The vulnerability is due to the presence of development testing and veri…
- CVE-2024-29075MEDIUMCVSS 4.6EG 4.62024-11-12
Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, a network-adjacent authenticated attacker may obtain or alter the settings of the device .
- CVE-2022-38453MEDIUMCVSS 3.0EG 4.42022-09-13
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive c…
- CVE-2022-27597MEDIUMCVSS 2.7EG 4.32023-03-29
A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating …
- CVE-2025-46674LOWCVSS 3.5EG 3.52025-04-27
NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracle.
Map vulnerabilities like CWE-489 to your infrastructure
EchelonGraph correlates every CVE — across CWE-489 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →