TI-2026-18207 Aliases CVE-2026-22679 GHSA-vg4v-xjcr-x7p5

Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

HIGH 81CWE-306Published 2026-04-07 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.20692 97th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed E-cology (Weaver Network Co., Ltd.): 20260312

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Weaver Network Co., Ltd.	E-cology	before 20260312	20260312	Patch available	CNA

E-cology VendorWeaver Network Co., Ltd. Affected before 20260312 Fixed in 20260312 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:weaver:e-cology::::::::	before 20260312	Vulnerable	Weaver

cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:* Versions before 20260312 Vulnerable ·Weaver

Remediation

Fix · CNA E-cology (Weaver Network Co., Ltd.) Fixed in 20260312

Timeline

2026-10-02 Threatist record created from CVE-2026-22679
2026-10-03 Alias added: GHSA-vg4v-xjcr-x7p5

References

TI-2022-26434 Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet CVSS 4.0CRITICAL 9.3
TI-2022-04582 Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp CVSS 4.0CRITICAL 9.3
TI-2025-43962 Unauthenticated SQL injection in Weaver E-cology CVSS 4.0HIGH 8.8
TI-2022-26436 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp CVSS 4.0HIGH 8.7
TI-2021-22764 Unauthenticated path traversal in Weaver E-cology reads server files CVSS 4.0HIGH 8.7
TI-2019-15817 Weaver E-cology SQL Injection via SyncUserInfo.jsp CVSS 4.0HIGH 8.7

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences