CVE-2026-58479
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin. An unauthenticated or CSRF attacker can store a malicious payload via the plugin's HTTP endpoint and then activate an irrigation station, leading to arbitrary OS command execution on the host.
Risk Assessment
The risk for the organization includes full compromise of the SIP system, potentially leading to data integrity breaches, disruption of irrigation infrastructure, and use of the host as a pivot point for further network attacks.
Recommendation
Immediately upgrade SIP to a version newer than 5.2.16, disable the cli_control plugin if not required, and change the default passphrase 'opendoor' to a strong, unique passphrase.
Original NVD description (English source)
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.