CVE-2026-58479
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin. An unauthenticated or CSRF attacker can store a malicious payload via the plugin's HTTP endpoint and then activate an irrigation station, leading to arbitrary OS command execution on the host.
Risk Assessment
The risk for the organization includes full compromise of the SIP system, potentially leading to data integrity breaches, disruption of irrigation infrastructure, and use of the host as a pivot point for further network attacks.
Recommendation
Immediately upgrade SIP to a version newer than 5.2.16, disable the cli_control plugin if not required, and change the default passphrase 'opendoor' to a strong, unique passphrase.
Other vulnerabilities in Sustainable Irrigation Platform
See all- CVE-2026-60114High
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.
- CVE-2026-58478Medium
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability. An unauthenticated attacker can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts when the optional Node-RED plugin is installed.
- CVE-2026-58477High
The Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.
- CVE-2026-58476High
A CSRF vulnerability in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows remote attackers to perform state-changing administrative actions by tricking a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. The default configuration (no passphrase, default credential 'opendoor') exposes these endpoints to unauthenticated users.
- CVE-2026-58475Medium
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability. Unauthenticated attackers can inject arbitrary JavaScript by supplying malicious payloads within program names submitted via HTTP requests.
Original NVD description (English source)
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.