CVE-2026-58475
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability. Unauthenticated attackers can inject arbitrary JavaScript by supplying malicious payloads within program names submitted via HTTP requests.
Risk Assessment
Attackers can execute arbitrary scripts in the browsers of users viewing the affected page, potentially leading to session theft, account takeover, or data theft. The risk is increased by the absence of a required passphrase or the use of the default passphrase 'opendoor'.
Recommendation
Immediately update SIP to the latest version and apply proper output encoding for program names. Additionally, change the default passphrase 'opendoor' to a strong, unique passphrase.
Other vulnerabilities in Sustainable Irrigation Platform
See all- CVE-2026-58479Critical
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin. An unauthenticated or CSRF attacker can store a malicious payload via the plugin's HTTP endpoint and then activate an irrigation station, leading to arbitrary OS command execution on the host.
- CVE-2026-60114High
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.
- CVE-2026-58478Medium
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability. An unauthenticated attacker can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts when the optional Node-RED plugin is installed.
- CVE-2026-58477High
The Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.
- CVE-2026-58476High
A CSRF vulnerability in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows remote attackers to perform state-changing administrative actions by tricking a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. The default configuration (no passphrase, default credential 'opendoor') exposes these endpoints to unauthenticated users.
Original NVD description (English source)
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.