Is there a public PoC exploit available for CVE-2026-58478?

Yes, a public proof-of-concept exploit is available for CVE-2026-58478. Prioritise patching immediately. EPSS: 0.3%.

Sustainable Irrigation Platform CVE-2026-58478

Q: What is the CVSS score of CVE-2026-58478?

CVE-2026-58478 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43689 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-14 VulnCheck

GHSA-2444-cfc6-gh44

SSRF Sip Dan In Ca

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable, no privileges required; scope changed because SSRF impacts internal systems; C:L/I:L reflects ability to probe and send requests to otherwise-inaccessible hosts.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:40 vuln.today

CVE Published

Jul 14, 2026 - 14:41 cve.org

MEDIUM 6.3

DescriptionCVE.org

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attackers can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts not otherwise directly accessible.

AnalysisAI

Server-side request forgery in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows unauthenticated network attackers to weaponize the device as an HTTP proxy against internal or external hosts. Exploitation requires the optional Node-RED plugin to be installed and leverages the known default passphrase 'opendoor' to bypass authentication to the plugin interface - dramatically lowering the practical barrier for blind SSRF. A publicly available proof-of-concept exploit exists per ZeroScience advisory ZSL-2026-5998; no CISA KEV listing at time of analysis.

Technical ContextAI

SIP (cpe:2.3:a:dan-in-ca:sip:*:*:*:*:*:*:*:*) is an open-source irrigation controller platform developed by dan-in-ca, commonly deployed in IoT and smart-agriculture contexts. The optional Node-RED plugin - a popular flow-based automation runtime used extensively in IoT stacks - exposes a callback URL endpoint that SIP processes without validating the destination host or scheme. CWE-918 (Server-Side Request Forgery) describes this root cause: the server constructs and issues an outbound HTTP request using attacker-controlled input, enabling internal network pivoting. Compounding the issue, the Node-RED plugin ships with or defaults to the passphrase 'opendoor', eliminating any meaningful authentication barrier for remote exploitation of that endpoint.

RemediationAI

No vendor-released patch version is confirmed from available data - the ZeroScience and VulnCheck advisories do not reference a fixed release. Until a patch is issued, the primary compensating control is to disable or uninstall the Node-RED plugin entirely if not operationally required, which eliminates the vulnerable callback URL endpoint. Where the plugin must remain active, immediately change the default passphrase 'opendoor' to a strong, unique value to reduce the authentication bypass risk. Additionally, implement egress firewall rules on the SIP device to restrict outbound HTTP connections to only known, necessary destinations, preventing SSRF from being used to probe internal networks. Network segmentation that places SIP devices on isolated VLANs with no internet egress provides further containment. Monitor for unexpected outbound HTTP traffic from SIP hosts as a detection signal. Refer to https://www.zeroscience.mk/#/advisories/ZSL-2026-5998 for technical details that may inform additional hardening.