CVE-2026-58479
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.
- CVSS 4.0
- 9.2 CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.40% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- dan-in-ca/sustainable irrigation platform
- Source
- disclosure@vulncheck.com
References
- https://www.vulncheck.com/advisories/sustainable-irrigation-platform-rce-via-cli-control-plugin-command-injectionThird Party Advisory
- https://www.zeroscience.mk/#/advisories/ZSL-2026-5999Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.