{"schema":"threatline.record/2","record":{"id":"CVE-2026-22679","aliases":[],"summary":"Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint","details":"Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).","categories":["Unclassified"],"product":"E-cology","vendor":"Weaver Network Co., Ltd.","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-22679","source_modified_at":"2026-07-14T15:53:29.433Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"E-cology","vendor":"Weaver Network Co., Ltd.","versions":[{"status":"affected","version":"0","lessThan":"20260312","versionType":"date"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-22679","source_modified_at":"2026-07-14T15:53:29.433Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"E-cology","ecosystem":null},"version":"20260312","basis":"first unaffected version stated in the CVE record"}],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.20359,"percentile":0.97468,"score_date":"2026-10-26"},"published_at":"2026-04-07T12:51:22.789Z","modified_at":"2026-07-14T15:53:29.433Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-22679","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-07-14T15:53:29.433Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22679","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.weaver.com.cn/cs/securityDownload.html#","tags":["release-notes"]},{"source":"CVE List","url":"https://h4cker.zip/post/d5d211/","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://ti.qianxin.com/vulnerability/notice-detail/1760","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://blog.vega.io/posts/cve-2026-22679-weaver-ecology-exploitation/","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-04-07T13:29:59.333562Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-07-14T15:53:29.433Z","content_hash":"48d6ba8477e3505c18017e7212564db773ed07a60321df3036f37ceba9d3579a"}}