CVE-2026-22679 - Vulnerability Analysis

Overview

Weaver (Fanwei) E-cology < 20260312 contains an unauthenticated remote code execution caused by exposed debug functionality in /papi/esearch/data/devops/dubboApi/debug/method endpoint, letting remote attackers execute arbitrary commands, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can execute arbitrary commands, potentially leading to full system compromise.

Mitigation

Update to version 20260312 or later.

References

• https://h4cker.zip/post/d5d211/
• https://ti.qianxin.com/vulnerability/notice-detail/1760
• https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint
• https://www.weaver.com.cn/cs/securityDownload.html#

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner