CVE-2026-22679
Published: 07 April 2026
Description
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and…
more
methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
Mitigating Controls (NIST 800-53 r5)AI
Requires timely flaw remediation, including application of Weaver-provided patches that eliminate the unauthenticated RCE vulnerability in the debug endpoint.
Limits permitted actions without identification or authentication, directly prohibiting unauthenticated access to the exposed debug endpoint enabling arbitrary command execution.
Enforces approved access control policies and associated access enforcements, preventing unauthorized POST requests to the vulnerable /debug/method endpoint.
Security SummaryAI
CVE-2026-22679 is an unauthenticated remote code execution vulnerability in Weaver (Fanwei) E-cology 10.0 versions prior to 20260312. The issue stems from exposed debug functionality in the /papi/esearch/data/devops/dubboApi/debug/method endpoint, which allows attackers to execute arbitrary commands. Exploitation occurs via crafted POST requests using attacker-controlled interfaceName and methodName parameters to invoke command-execution helpers, as classified under CWE-306 (Missing Authentication for Critical Function). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require only network access and need no authentication, privileges, or user interaction to exploit the endpoint. Successful exploitation grants arbitrary command execution on the affected system, enabling full compromise including data exfiltration, persistence, or further lateral movement.
Advisories from VulnCheck, QiAnXin Threat Intelligence, and others, including exploitation details and PoCs, are available at referenced URLs such as https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint and https://ti.qianxin.com/vulnerability/notice-detail/1760. Weaver provides patches via their security download page at https://www.weaver.com.cn/cs/securityDownload.html#.
Exploitation evidence was first observed in the wild by the Shadowserver Foundation on 2026-03-31 (UTC), ahead of CVE publication on 2026-04-07T13:16:45.400.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE vulnerability in a public-facing web application endpoint (/papi/esearch/data/devops/dubboApi/debug/method) via crafted POST requests, directly enabling exploitation of public-facing applications.