The product is released with debugging code still enabled or active.

What CVEs are caused by CWE-489?

81 recorded CVEs are attributed to CWE-489, including CVE-2023-4804, CVE-2025-46674, CVE-2024-9643.

Is CWE-489 part of the OWASP Top 10?

CWE-489 maps to OWASP Top Ten 2004: Insecure Configuration Management (A10) in the OWASP security taxonomy.

Is CWE-489 actively exploited?

81 recorded CVEs are caused by CWE-489; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-489: Active Debug Code (Leftover debug code)

Overview

CWE-489 (Active Debug Code) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

81 recorded CVEs are caused by CWE-489 (Active Debug Code). The highest-severity and most recent are shown first. 14 new CWE-489 CVEs have been recorded so far in 2026 (15 in 2025).

Showing 12 of 81 recorded CWE-489 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-489 vulnerabilities

Common consequences

What can happen when CWE-489 is exploited.

Bypass Protection Mechanism, Read Application Data, Gain Privileges or Assume Identity, Varies by Context

Affects: Confidentiality, Integrity, Availability, Access Control, Other

Active debug code can create unintended entry points or expose sensitive information. The severity of the exposed debug code will depend on the particular instance. At the least, it will give an attacker sensitive information about the settings and mechanics of web applications on the server. At worst, as is often the case, the debug code will allow an attacker complete control over the web application and server, as well as confidential information that either of these access.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

Build and Compilation

Operation

Applies to

Technologies

ICS/OT

How to prevent it

Practical mitigations for CWE-489, grouped by where in the lifecycle they apply.

Build and Compilation

Distribution

Remove debug code before deploying the application.

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

Debug code can be used to bypass authentication. For example, suppose an application has a login script that receives a username and a password. Assume also that a third, optional, parameter, called "debug", is interpreted by the script as requesting a switch to debug mode, and that when this parameter is given the username and password are not checked. In such a case, it is very simple to bypass the authentication process if the special behavior of the application regarding the debug parameter is known. In a case where the form is:

Vulnerable example

xml

<FORM ACTION="/authenticate_login.cgi">

Example

plaintext

http://TARGET/authenticate_login.cgi?username=...&password=...

Attack input

plaintext

http://TARGET/authenticate_login.cgi?username=&password=&debug=1

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2024-44092 — smartphone is built for production with debugging code present, allowing local privilege escalation
CVE-2024-36475 — network hub contains active debug code, which allows users to execute arbitrary OS commands using a debug function
CVE-2024-29075 — Mesh Wi-Fi router has active debug code, allowing attackers to modify device settings

How this weakness relates to others in the CWE hierarchy.

Terminology & mappings

Alternate terms

Leftover debug code: This term originates from Seven Pernicious Kingdoms

Mapped taxonomies

7 Pernicious Kingdoms: Leftover Debug Code
OWASP Top Ten 2004: Insecure Configuration Management (A10) — CWE More Specific fit
Software Fault Patterns: Unexpected access points (SFP28)

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-489.

What is CWE-489?: The product is released with debugging code still enabled or active.
What CVEs are caused by CWE-489?: 81 recorded CVEs are attributed to CWE-489, including CVE-2023-4804, CVE-2025-46674, CVE-2024-9643.
Is CWE-489 part of the OWASP Top 10?: CWE-489 maps to OWASP Top Ten 2004: Insecure Configuration Management (A10) in the OWASP security taxonomy.
How do you prevent CWE-489?: Remove debug code before deploying the application.
How is CWE-489 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-489?: Exploiting CWE-489 can lead to: Bypass Protection Mechanism, Read Application Data, Gain Privileges or Assume Identity, Varies by Context.
Is CWE-489 actively exploited?: 81 recorded CVEs are caused by CWE-489; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.