A vulnerability labeled as critical has been found in Weaver Network e-cology 10.0/2026-03-31 . The impacted element is an unknown function of the file /papi/esearch/data/devops/dubboApi/debug/method of the component POST Request Handler . Such manipulation of the argument interfaceName/methodName leads to missing authentication. This vulnerability is documented as CVE-2026-22679 . The attack can be executed remotely. Additionally, an exploit exists. The affected component should be upgraded.
Full text archived locally
✦ AI Summary· Claude Sonnet
VDB-355737 · CVE-2026-22679 · EUVD-2026-19607
WEAVER NETWORK E-COLOGY 10.0/2026-03-31 POST REQUEST METHOD INTERFACENAME/METHODNAME MISSING AUTHENTICATION
HISTORYDIFFRELATEJSONXMLCTI
CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score
9.6 $0-$5k 2.43+
Summaryinfo
A vulnerability marked as critical has been reported in Weaver Network e-cology 10.0/2026-03-31. This affects an unknown function of the file /papi/esearch/data/devops/dubboApi/debug/method of the component POST Request Handler. Performing a manipulation of the argument interfaceName/methodName results in missing authentication. This vulnerability is reported as CVE-2026-22679. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.
Detailsinfo
A vulnerability, which was classified as very critical, was found in Weaver Network e-cology 10.0/2026-03-31. This affects an unknown code of the file /papi/esearch/data/devops/dubboApi/debug/method of the component POST Request Handler. The manipulation of the argument interfaceName/methodName with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
The advisory is shared at weaver.com.cn. This vulnerability is uniquely identified as CVE-2026-22679 since 01/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a exploit are known. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/07/2026).
It is declared as highly functional.
Upgrading to version 20260312 eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-19607).
Productinfo
Vendor
Weaver Network
Name
e-cology
Version
10.0
2026-03-31
CPE 2.3info
🔒
🔒
CPE 2.2info
🔒
🔒
CVSSv4info
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒
CVSSv3info
VulDB Meta Base Score: 9.8
VulDB Meta Temp Score: 9.6
VulDB Base Score: 9.8
VulDB Temp Score: 9.4
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 9.8
CNA Vector (VulnCheck): 🔒
CVSSv2info
Vector Complexity Authentication Confidentiality Integrity Availability
Unlock Unlock Unlock Unlock Unlock Unlock
Unlock Unlock Unlock Unlock Unlock Unlock
Unlock Unlock Unlock Unlock Unlock Unlock
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploitinginfo
Class: Missing authentication
CWE: CWE-306 / CWE-287
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Highly functional
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day Unlock Unlock Unlock Unlock
Today Unlock Unlock Unlock Unlock
Threat Intelligenceinfo
Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍
Countermeasuresinfo
Recommended: Upgrade
Status: 🔍
0-Day Time: 🔒
Upgrade: e-cology 20260312
Timelineinfo
01/08/2026 CVE reserved
04/07/2026 +88 days Advisory disclosed
04/07/2026 +0 days VulDB entry created
04/07/2026 +0 days VulDB entry last update
Sourcesinfo
Advisory: weaver.com.cn
Status: Confirmed
CVE: CVE-2026-22679 (🔒)
GCVE (CVE): GCVE-0-2026-22679
GCVE (VulDB): GCVE-100-355737
EUVD: 🔒
scip Labs: https://www.scip.ch/en/?labs.20161013
Entryinfo
Created: 04/07/2026 15:26
Updated: 04/07/2026 17:04
Changes: 04/07/2026 15:26 (79), 04/07/2026 17:04 (1)
Complete: 🔍
Cache ID: 99:502:101
Discussion
No comments yet. Languages: en.
Please log in to comment.
◂ PreviousOverviewNext ▸