Which versions of Sustainable Irrigation Platform are affected by CVE-2026-58477?

The Sustainable Irrigation Platform (SIP) through version 5.2.16 allows remote unauthenticated attackers to tamper with critical system configuration, including security passphrases and network…

Is there a public PoC exploit available for CVE-2026-58477?

Yes, a public proof-of-concept exploit is available for CVE-2026-58477. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-58477?

Within 24 hours, implement network-level access controls to restrict HTTP/HTTPS traffic to SIP administrative interfaces to trusted management networks and IP ranges only. Within 7 days, deploy a Web Application Firewall (WAF) configured with an allow-list for expected HTTP parameter names specific to SIP version 5.2.16, enable request logging for injection attempts matching ZeroScience ZSL-2026-5997 exploit patterns, and conduct an audit of recent SIP configuration change logs to detect evidence of prior exploitation. Within 30 days, establish continuous monitoring of SIP configuration settings with alerting on unauthorized modifications, design a planned upgrade to SIP version 5.2.17 or later once vendor patches are released, and consider deploying SIP instances on air-gapped networks or behind mandatory authentication proxies until patched versions are available.

Sustainable Irrigation Platform CVE-2026-58477

Q: What is the CVSS score of CVE-2026-58477?

CVE-2026-58477 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43688 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-14 VulnCheck

GHSA-6862-8mf9-7vg4

CSRF Sip

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Unauthenticated network parameter injection (AV:N/AC:L/PR:N/UI:N) overwrites config for high integrity impact; changing the listening port yields low availability impact and no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:32 vuln.today

CVE Published

Jul 14, 2026 - 14:39 cve.org

HIGH 8.8

DescriptionCVE.org

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.

AnalysisAI

Configuration tampering in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets remote unauthenticated attackers overwrite sensitive settings - including the passphrase and listening port - by injecting arbitrary parameter names into HTTP requests. Because the application binds request parameters directly to internal configuration objects without an allow-list, the same effect can be triggered blindly through cross-site request forgery against an authenticated operator's browser. Publicly available exploit code exists (ZeroScience ZSL-2026-5997), but there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic mass assignment / autobind vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes). SIP appears to be a web-based control application (CPE cpe:2.3:a:dan-in-ca:sip) for irrigation management that maps inbound HTTP request parameters onto server-side configuration properties. When a framework auto-populates object fields from request keys and the developer does not restrict which fields are writable (no allow-list/deny-list, no per-field authorization), an attacker can set fields that were never meant to be exposed to the request layer - here the security passphrase and the network listening port. The additional CSRF exposure indicates the same state-changing endpoints lack anti-CSRF tokens or origin validation, so writes can be forged from a third-party site.

RemediationAI

No vendor-released patch version was identified at time of analysis, so upgrade guidance cannot cite an exact fixed release - monitor the vendor and the VulnCheck advisory (https://www.vulncheck.com/advisories/sustainable-irrigation-platform-mass-assignment-via-http-parameters) and ZeroScience advisory (https://www.zeroscience.mk/#/advisories/ZSL-2026-5997) for a fixed build. As compensating controls, restrict network access to the SIP web interface to trusted management networks or a VPN so the unauthenticated parameter-injection endpoint is not internet-exposed (trade-off: remote operators lose direct access); place SIP behind a reverse proxy or WAF that strips or allow-lists request parameters to only expected fields, blocking injection of passphrase/port keys (trade-off: requires knowing the legitimate parameter set); and mitigate the CSRF vector by enforcing SameSite=Strict cookies and, where the proxy allows, validating Origin/Referer headers on state-changing requests (trade-off: may break legitimate cross-origin automation). Rotate the passphrase after patching in case it was already overwritten.