CWE · MITRE source
CWE-1295Debug Messages Revealing Unnecessary Information
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
Debug messages are messages that help troubleshoot an issue by revealing the internal state of the system. For example, debug data in design can be exposed through internal memory array dumps or boot logs through interfaces like UART via TAP commands, scan chain, etc. Thus, the more information contained in a debug message, the easier it is to debug. However, there is also the risk of revealing information that could help an attacker either decipher a vulnerability, and/or gain a better understanding of the system. Thus, this extra information could lower the "security by obscurity" factor. While "security by obscurity" alone is insufficient, it can help as a part of "Defense-in-depth".
Last updated: 14 October 2026 20:41 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 3 mapping(s) from 3 framework(s): STIG windows 10 1 (partial) · STIG windows server 2016 1 (partial) · STIG windows server 2019 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-38516 UPD | 6.6 | 8.8 | 0.0051 | 2024-06-25 |
CVE-2024-45784 UPD | 6.1 | 7.5 | 0.0134 | 2024-11-15 |
CVE-2026-28811 | 6.0 | 7.5 | 0.0079 | 2026-07-30 |
CVE-2023-5392 UPD | 5.9 | 7.5 | 0.0048 | 2024-04-11 |
CVE-2025-31001 UPD | 5.9 | 7.5 | 0.0050 | 2025-04-01 |
CVE-2023-4215 UPD | 5.2 | 6.5 | 0.0056 | 2023-10-17 |
CVE-2025-2877 UPD | 5.1 | 6.5 | 0.0041 | 2025-03-28 |
CVE-2021-31412 UPD | 4.7 | 5.3 | 0.0132 | 2021-06-24 |
CVE-2025-12910 UPD | 4.6 | 6.2 | 0.0011 | 2025-11-08 |
CVE-2025-46775 | 4.2 | 5.5 | 0.0016 | 2025-11-18 |
CVE-2024-11217 UPD | 3.9 | 4.9 | 0.0037 | 2024-11-15 |
CVE-2024-27179 UPD | 3.7 | 4.7 | 0.0026 | 2024-06-14 |
CVE-2022-34364 UPD | 3.5 | 4.4 | 0.0019 | 2023-02-10 |
CVE-2023-28077 UPD | 3.5 | 4.4 | 0.0018 | 2024-02-10 |
CVE-2025-2469 UPD | 3.3 | 3.7 | 0.0039 | 2025-04-10 |
CVE-2021-25476 UPD | 3.1 | 4.1 | 0.0010 | 2021-10-06 |
CVE-2025-20643 | 2.9 | 3.9 | 0.0009 | 2025-02-03 |
CVE-2025-35031 UPD | 2.8 | 3.3 | 0.0014 | 2025-09-29 |
CVE-2022-27597 UPD | 2.7 | 2.7 | 0.0066 | 2023-03-29 |