CVE-2026-22679

Katalog CVE

CVSS 9.8 · Critical EPSS 20,4%

Kerentanan Missing Authentication for Critical Function pada weaver e-cology. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

Rincian

Terbit di NVD

7 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

20,4% peluang dieksploitasi; lebih tinggi dari 97,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.weaver.com.cn/cs/securityDownload.html# patch
• https://ti.qianxin.com/vulnerability/notice-detail/1760 advisory pihak ketiga
• https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint advisory pihak ketiga
• https://h4cker.zip/post/d5d211/ broken link
• https://blog.vega.io/posts/cve-2026-22679-weaver-ecology-exploitation/