9.8 CriticalCWE-306
CVE-2026-22679
Weaver Network Co., Ltd. E-cology vulnerability
Weaver Network Co., Ltd.E-cology
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
20%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 5 May · 08:11 UTC | The Hacker News | CVE-2026-22679 hits Weaver E‑cology via debug API, enabling RCE |
| Tue 5 May · 10:01 UTC | SecurityWeek | MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs |
- MetInfo, Weaver E-cology Vulnerabilities in Attackers’ CrosshairsSecurityWeek · mentions it in passing
- CVE-2026-22679 hits Weaver E‑cology via debug API, enabling RCEThe Hacker News · first in our coverage