Sustainable Irrigation Platform CVE-2026-58478

The Node-RED plugin must be installed on SIP - this is explicitly described as optional and is therefore a non-default deployment condition that substantially limits the exposed population. When present, the plugin endpoint accepts a caller-controlled callback URL without validating the destination host, and the known default passphrase 'opendoor' provides an effective authentication bypass. The CVSS 4.0 vector PR:N confirms unauthenticated exploitation is possible once the plugin is present. Exploitation is limited to: (1) instances with the Node-RED plugin installed, and (2) instances where the default passphrase has not been changed. Deployments without the Node-RED plugin are not affected. No user interaction is required and the attack is network-reachable (AV:N), meaning any attacker with HTTP access to the SIP device's callback endpoint can trigger the SSRF.

The CVSS 4.0 score of 6.3 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N reflects an important nuance: AT:P indicates a specific attack requirement - the Node-RED plugin must be installed. This is the primary limiter and is explicitly non-default. Impact is confined to subsequent systems (SC:L/SI:L), as the vulnerable system itself has no direct C/I/A impact - characteristic of SSRF as an internal-pivoting primitive rather than a direct RCE or data-theft vector. No EPSS data was provided; no KEV listing exists, suggesting exploitation is not yet widespread. However, the publicly available POC from ZeroScience and the hardcoded default passphrase 'opendoor' significantly lower the exploitation bar for any attacker who can identify an exposed SIP instance with Node-RED enabled. The overall risk profile is elevated above the raw score for deployments running the Node-RED plugin with the default passphrase unchanged, and reduced substantially for those not running the plugin at all.

An attacker discovers an internet-exposed SIP device with the Node-RED plugin installed and authenticates (or bypasses authentication) using the default passphrase 'opendoor'. They submit a crafted HTTP request to the callback URL endpoint specifying an internal RFC-1918 address - for example, a management interface on the local 192.168.x.x subnet - causing SIP to issue a blind HTTP request to that internal host. The attacker can enumerate internal services, probe for unauthenticated management consoles, or chain the SSRF into further exploitation of systems unreachable from the public internet. A public POC demonstrating this technique is available via ZeroScience advisory ZSL-2026-5998.