Weaver E-cology 10.0 versions before 20260312 contain a missing authentication vulnerability (CWE-306) in a debug API endpoint (/papi/esearch/data/devops/dubboApi/debug/method). Attackers can send POST requests with attacker-controlled parameters (interfaceName and methodName) to invoke command-execution helpers, resulting in arbitrary remote code execution. This vulnerability is remotely exploitable without any privileges or user interaction and has a CVSS 4.0 base score of 9.3, indicating critical severity. Exploitation was first observed in March 2026. No patch or official remediation level has been disclosed.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the affected system, potentially leading to full system compromise. The vulnerability affects Weaver E-cology 10.0 prior to 20260312. Given the high CVSS score and the nature of the flaw, the impact is critical, enabling attackers to bypass authentication controls and execute code remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint by network controls or firewall rules to prevent unauthenticated access. Monitor for unusual activity targeting the /papi/esearch/data/devops/dubboApi/debug/method endpoint. Do not expose this service to untrusted networks.