CVE-2026-60114
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.
Risk Assessment
The risk for the organization includes potential remote code execution or privilege escalation by overwriting critical configuration files or scripts, which could lead to full compromise of the SIP system and data integrity violation.
Recommendation
It is recommended to immediately upgrade Sustainable Irrigation Platform to a version later than 5.2.16, enforce a strong passphrase for the restore functionality, and validate all JSON keys before using them to construct file paths.
Other vulnerabilities in Sustainable Irrigation Platform
See all- CVE-2026-58479Critical
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin. An unauthenticated or CSRF attacker can store a malicious payload via the plugin's HTTP endpoint and then activate an irrigation station, leading to arbitrary OS command execution on the host.
- CVE-2026-58478Medium
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability. An unauthenticated attacker can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts when the optional Node-RED plugin is installed.
- CVE-2026-58477High
The Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.
- CVE-2026-58476High
A CSRF vulnerability in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows remote attackers to perform state-changing administrative actions by tricking a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. The default configuration (no passphrase, default credential 'opendoor') exposes these endpoints to unauthenticated users.
- CVE-2026-58475Medium
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability. Unauthenticated attackers can inject arbitrary JavaScript by supplying malicious payloads within program names submitted via HTTP requests.
Original NVD description (English source)
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.