CWE-489 · Misconfiguration and Insecure Design
Active Debug Code
100CVEs
0exploited
2with a public check
3likely (EPSS 10%+)
SortMost likely exploited
100 CVEs with CWE-489 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-9643CheckFour-Faith F3x36 - Authentication BypassFour-Faith · F3x36 · CVSS 9.8 · 2025-02-04 | 9.8 | 3.0% | 2025-02-04 |
| CVE-2026-9133CheckAmazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File ReadAWS · RabbitMQ AWS · CVSS 7.7 · 2026-05-20 | 7.7 | 1.1% | 2026-05-20 |
| CVE-2023-32645A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to authenticatio…Yifan · YF325 · CVSS 9.8 · 2023-10-11 | 9.8 | 55% | 2023-10-11 |
| CVE-2017-5259In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-o…Cambium Networks · cnPilot · 2017-12-20 | – | 33% | 2017-12-20 |
| CVE-2022-20649Cisco Redundancy Configuration Manager Debug Remote Code Execution VulnerabilityCisco · Cisco Redundancy Configuration Manager · CVSS 8.1 · 2024-11-15 | 8.1 | 12% | 2024-11-15 |
| CVE-2022-38715A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote…Siretta · QUARTZ-GOLD · CVSS 7.2 · 2023-01-26 | 7.2 | 3.8% | 2023-01-26 |
| CVE-2018-5454Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enabled, which could allow an attacker to remotely execute arbit…Philips · Philips IntelliSpace Portal · 2018-03-26 | – | 3.4% | 2018-03-26 |
| CVE-2022-29520An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lea…abode systems, inc. · iota All-In-One Security Kit · CVSS 8.1 · 2022-10-25 | 8.1 | 3.1% | 2022-10-25 |
| CVE-2022-32585A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An a…Robustel · R1510 · CVSS 9.1 · 2022-06-30 | 9.1 | 3.0% | 2022-06-30 |
| CVE-2021-3972A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker wi…Lenovo · Notebook BIOS · CVSS 6.7 · 2022-04-22 | 6.7 | 2.9% | 2022-04-22 |
| CVE-2022-25995A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary comma…InHand Networks · InRouter302 · CVSS 9.9 · 2022-05-12 | 9.9 | 2.9% | 2022-05-12 |
| CVE-2020-5763Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by correctly answering…Grandstream · Grandstream HT800 Series · 2020-07-29 | – | 2.7% | 2020-07-29 |
| CVE-2020-5756Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionalit…Tenable · Grandstream GWN7000 · 2020-07-17 | – | 2.5% | 2020-07-17 |
| CVE-2022-29888A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arb…InHand Networks · InRouter302 · CVSS 6.5 · 2022-11-09 | 6.5 | 1.6% | 2022-11-09 |
| CVE-2021-33591An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.NAVER · Naver Comic Viewer · 2021-05-28 | – | 1.6% | 2021-05-28 |
| CVE-2024-21785A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of network requests ca…AutomationDirect · P3-550E · CVSS 9.8 · 2024-05-28 | 9.8 | 1.5% | 2024-05-28 |
| CVE-2023-34346A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command ex…Yifan · YF325 · CVSS 9.8 · 2023-10-11 | 9.8 | 1.4% | 2023-10-11 |
| CVE-2022-33971Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all…OMRON Corporation · Machine automation controller NJ series, Machine automation controller NX serie… · CVSS 8.3 · 2022-07-04 | 8.3 | 1.3% | 2022-07-04 |
| CVE-2021-3971A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow…Lenovo · Notebook BIOS · CVSS 6.7 · 2022-04-22 | 6.7 | 1.2% | 2022-04-22 |
| CVE-2021-40419A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted series of network requests can lead to arbitrary firmwa…Reolink · Rlc-410w Firmware · CVSS 10 · 2022-01-28 | 10.0 | 1.2% | 2022-01-28 |
| CVE-2023-22357Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote un…OMRON Corporation · CP1L-EL20DR-D · CVSS 9.8 · 2023-01-17 | 9.8 | 1.2% | 2023-01-17 |
| CVE-2022-33323Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-seriesMitsubishi Electric Corporation · MELFA SD/SQ Series Controller CR1DA-771 of RV-2SD · CVSS 7.5 · 2023-02-02 | 7.5 | 1.2% | 2023-02-02 |
| CVE-2020-25156B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG · SpaceCom · CVSS 7.2 · 2022-04-14 | 7.2 | 1.2% | 2022-04-14 |
| CVE-2024-29511Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary…Artifex · Ghostscript · CVSS 7.5 · 2024-07-03 | 7.5 | 1.1% | 2024-07-03 |
| CVE-2022-28689A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary c…InHand Networks · InRouter302 · CVSS 6.5 · 2022-11-09 | 6.5 | 1.1% | 2022-11-09 |
| CVE-2023-1618Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface ModuleMitsubishi Electric Corporation · MELSEC WS Series WS0-GETH00200 · CVSS 7.5 · 2023-05-19 | 7.5 | 1.1% | 2023-05-19 |
| CVE-2019-10939A vulnerability has been identified in TIM 3V-IE (incl. SIPLUS NET variants) (All versions < V2.8), TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All versions < V2.8), TIM 3V-IE…Siemens AG · TIM 3V-IE (incl. SIPLUS NET variants) · 2020-04-14 | – | 1.1% | 2020-04-14 |
| CVE-2022-30543A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to ex…InHand Networks · InRouter302 · CVSS 4.3 · 2022-11-09 | 4.3 | 1.1% | 2022-11-09 |
| CVE-2023-49593Leftover debug code exists in the boa formSysCmd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A specially crafted network request can lead to arbitrary com…LevelOne · WBR-6013 · CVSS 7.2 · 2024-07-08 | 7.2 | 1.1% | 2024-07-08 |
| CVE-2022-32760A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to…abode systems, inc. · iota All-In-One Security Kit · CVSS 8.6 · 2022-10-25 | 8.6 | 1.0% | 2022-10-25 |
| CVE-2023-4804Quantum HD UnityJohnson Controls · Quantum HD Unity Compressor · CVSS 10 · 2023-11-10 | 10.0 | 1.0% | 2023-11-10 |
| CVE-2022-26023A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to d…InHand Networks · InRouter302 · CVSS 6.5 · 2022-11-09 | 6.5 | 0.9% | 2022-11-09 |
| CVE-2022-29481A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to di…InHand Networks · InRouter302 · CVSS 4.9 · 2022-11-09 | 4.9 | 0.9% | 2022-11-09 |
| CVE-2024-21827A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted ser…Tp-Link · ER7206 Omada Gigabit VPN Router · CVSS 7.2 · 2024-06-25 | 7.2 | 0.9% | 2024-06-25 |
| CVE-2022-45677SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php.Tuition Management System Project · Tuition Management System · CVSS 9.8 · 2023-02-21 | 9.8 | 0.9% | 2023-02-21 |
| CVE-2021-23861Possible Access to Debug Functions in Bosch VRM / BVMSBosch · BVMS · CVSS 6.5 · 2021-12-08 | 6.5 | 0.8% | 2021-12-08 |
| CVE-2024-46873Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker.Sharp Corporation · home 5G HR02 · CVSS 9.8 · 2024-12-23 | 9.8 | 0.7% | 2024-12-23 |
| CVE-2026-115727AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_serverFosowl · AgenticSeek · CVSS 8.1 · 2026-10-23 | 8.1 | 0.7% | 2026-10-23 |
| CVE-2026-13313An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telne…ASUS · Router · CVSS 8.9 · 2026-10-01 | 8.9 | 0.7% | 2026-10-01 |
| CVE-2023-0954Debug feature in Sensormatic Electronics Illustra Dome and PTZ camerasSensormatic Electronics, a subsidiary of Johnson Controls,… · Illustra Pro Gen 4 Dome · CVSS 8.3 · 2023-06-08 | 8.3 | 0.7% | 2023-06-08 |
| CVE-2026-41186Unauthenticated Go pprof exposure in Calico debug serverTigera · Calico · CVSS 6 · 2026-07-30 | 6.0 | 0.7% | 2026-07-30 |
| CVE-2024-9644Four-Faith F3x36 bapply.cgi Auth BypassFour-Faith · F3x36 · CVSS 9.8 · 2025-02-04 | 9.8 | 0.7% | 2025-02-04 |
| CVE-2026-59092JuiceFS - Authentication Bypass via pprof and metrics Endpointsjuicedata · juicefs · CVSS 7.7 · 2026-07-02 | 7.7 | 0.7% | 2026-07-02 |
| CVE-2026-84486Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advis…Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9 · CVSS 8.2 · 2026-09-23 | 8.2 | 0.7% | 2026-09-23 |
| CVE-2024-28008Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P…NEC Corporation · WG1800HP4 · CVSS 9.8 · 2024-03-28 | 9.8 | 0.6% | 2024-03-28 |
| CVE-2024-36475FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function…Century Systems Co., Ltd. · FutureNet NXR-1300 series · CVSS 7.2 · 2024-07-17 | 7.2 | 0.6% | 2024-07-17 |
| CVE-2025-46674NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracle.NASA · CryptoLib · CVSS 3.5 · 2025-04-27 | 3.5 | 0.6% | 2025-04-27 |
| CVE-2026-40035Unfurl - Werkzeug Debugger Exposure via String Config Parsingobsidianforensics · unfurl · CVSS 9.1 · 2026-04-08 | 9.1 | 0.6% | 2026-04-08 |
| CVE-2026-120637CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHODCGI · CVSS 9.8 · 2026-11-03 | 9.8 | 0.5% | 2026-11-03 |
| CVE-2022-46156Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive informationgrafana · synthetic-monitoring-agent · CVSS 7.2 · 2022-11-30 | 7.2 | 0.5% | 2022-11-30 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.