Sustainable Irrigation Platform CVE-2026-58477

The direct attack requires only network reachability to the SIP HTTP interface and no authentication (AV:N/AC:L/PR:N/UI:N) against SIP up to and including version 5.2.16 - the attacker supplies parameter names corresponding to sensitive config values such as the passphrase and listening port, and the vulnerable autobind logic accepts them. The CSRF variant instead requires an authenticated operator to be tricked into visiting an attacker-controlled page while their SIP session is active, i.e. it depends on user interaction and an existing session rather than on direct unauthenticated access. Limiting factors: the interface must be network-reachable (mitigated if SIP is on an isolated OT/management segment), and the attacker benefits from knowing valid internal parameter names, which the public POC discloses.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L) and 8.8 base score describe network-reachable, low-complexity, unauthenticated exploitation with high integrity impact and low availability impact - consistent with the description of arbitrary configuration overwrite. Confidentiality is rated none (VC:N), which is coherent: the attack changes settings rather than reading data. A working POC raises practical risk above raw score, but no EPSS probability, no SSVC decision, and no KEV entry were provided, so widespread automated exploitation cannot be asserted - treat exploitation likelihood as plausible-but-unquantified. The primary tension to verify: the CVSS marks this fully unauthenticated (PR:N) via HTTP parameters, yet the CSRF pathway inherently relies on an authenticated victim's session, so the two exploitation routes have different prerequisites - the direct parameter-injection route is the unauthenticated one. Overall this is a genuine high-priority integrity issue for anyone running SIP, tempered by the product's likely small deployment footprint.

An attacker who can reach the SIP web interface sends a crafted HTTP request containing parameter names matching internal config fields (e.g. the passphrase and listening port), causing the server to overwrite those settings and hand the attacker control of the platform's security state. Alternatively, the attacker lures an authenticated operator to a malicious web page that auto-submits a forged request, achieving the same configuration overwrite via CSRF. A public POC (ZeroScience ZSL-2026-5997) demonstrates the technique, and the low attack complexity means little tuning is required.