An unauthenticated remote code execution vulnerability exists in Weaver E‑Cology 10.0 systems. The flaw is exposed via the /papi/esearch/data/devops/dubboApi/debug/method endpoint, which accepts arbitrary interfaceName and methodName parameters in POST requests. Attackers can trigger command‑execution helpers and run arbitrary shell commands, giving them full control over the affected system. The weakness corresponds to inappropriate authentication controls (CWE‑306).

The vulnerability affects Weaver Network Co., Ltd.’s E‑Cology 10.0 software, with all versions released before 20260312 being vulnerable. No other vendors or product variants are known to be impacted.

The CVSS score of 9.3 denotes a critical severity. The EPSS score is unavailable, but the exploit was observed by the Shadowserver Foundation on 2026‑03‑31, indicating real-world use. Attackers can reach the debug endpoint over HTTP and craft malicious POST payloads to trigger the vulnerability; this attack path does not require prior authentication, as the endpoint lacks enforcement, making exploitation straightforward. The vulnerability is not yet listed in CISA’s KEV catalog, but its critical score and documented exploitation suggest high potential risk.