An unauthenticated’s E‑Cology 10.0 software, triggered through the /papi/esearch/data/devops/dubboApi/debug/method endpoint. The endpoint accepts POST requests with interfaceName and methodName parameters that an attacker can control, leading the system to invoke command‑execution helpers and run arbitrary shell commands. This weakness is categorized as a lack of proper authentication control (CWE‑306) and allows a remote actor to gain full control over the affected environment.

The vulnerability affects all releases of Weaver Network Co., Ltd.’s E‑Cology 10.0 software prior to the 20260312 release. No other vendors or product variants are listed as impacted.

The CVSS score of 9.3 classifies the issue as critical, and the EPSS score of 21% indicates a relatively high likelihood of real‑world exploitation. The attack path requires no authentication and can be executed by sending crafted POST requests over HTTP to the debug endpoint. Although the vulnerability is not yet listed in CISA’s KEV catalog, documented exploitation by the Shadowserver Foundation and the high severity metrics suggest that it represents a significant risk to any exposed installation.