Which versions of Sustainable Irrigation Platform are affected by CVE-2026-58479?

The Sustainable Irrigation Platform (SIP) versions through 5.2.16 contain a critical remote command injection vulnerability in the optional cli_control plugin; publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-58479?

Yes, a public proof-of-concept exploit is available for CVE-2026-58479. Prioritise patching immediately. EPSS: 5.2%.

How to fix or mitigate CVE-2026-58479?

Within 24 hours, disable or restrict network access to the cli_control plugin HTTP endpoint on all SIP installations running version 5.2.16 or earlier; if disabling is not operationally feasible, implement firewall rules or network segmentation to limit access to trusted sources only. Within 7 days, conduct an inventory of all SIP deployments to identify instances running version 5.2.16 or earlier with the cli_control plugin enabled, review historical logs for suspicious HTTP requests to plugin endpoints, and verify that default credentials (passphrase 'opendoor') are not in use. Within 30 days, monitor vendor communications for patch availability and develop a comprehensive remediation plan; in parallel, implement application firewall (WAF) rules to detect and block command injection attempts targeting the plugin endpoint and evaluate permanent decommissioning of the cli_control plugin if not operationally critical.

Sustainable Irrigation Platform CVE-2026-58479

Q: What is the CVSS score of CVE-2026-58479?

CVE-2026-58479 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 5.2%.

EUVD-2026-43690 CRITICAL

OS Command Injection (CWE-78)

2026-07-14 VulnCheck

GHSA-j4xr-2mrh-gcch

Command Injection CSRF Sip Dan In Ca

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) via absent/default passphrase, but execution is gated on station activation (AC:H); full RCE gives C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:34 vuln.today

CVE Published

Jul 14, 2026 - 14:44 cve.org

CRITICAL 9.2

DescriptionCVE.org

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.

AnalysisAI

Remote command injection in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets unauthenticated or CSRF-driven attackers store a malicious payload via the optional cli_control plugin's HTTP endpoint and execute arbitrary OS commands on the host when the linked irrigation station is activated. Because the plugin ships with no passphrase protection or the well-known default passphrase 'opendoor', exploitation is trivial on default installs. Publicly available exploit code exists (ZeroScience/VulnCheck), though the flaw is not listed in CISA KEV, and the CVSS 4.0 base score is 9.2 (Critical).

Technical ContextAI

SIP (dan-in-ca:sip) is an open-source, Python-based sprinkler/irrigation controller commonly run on single-board computers such as the Raspberry Pi, extensible through a plugin architecture. The vulnerability lives in the optional cli_control plugin, which is designed to run shell/CLI commands tied to irrigation station events. The root cause is CWE-78 (OS Command Injection): attacker-controlled input submitted to the plugin's HTTP endpoint is stored and later passed to an operating-system command interpreter without sanitization, so shell metacharacters or a full command string are executed as the SIP process user. The weakness is compounded by an authentication/authorization gap in the plugin's passphrase gate, which is either absent or left at the hard-coded default 'opendoor'.

RemediationAI

No vendor-released fixed version is identified in the provided data, so treat this as: No vendor-released patch identified at time of analysis - monitor the SIP project and the VulnCheck advisory (https://www.vulncheck.com/advisories/sustainable-irrigation-platform-rce-via-cli-control-plugin-command-injection) for a patched release. As immediate compensating controls: disable or uninstall the optional cli_control plugin entirely if it is not required (removes the vulnerable endpoint at the cost of losing CLI-triggered station actions); if the plugin must stay, set a strong, unique passphrase and remove the default 'opendoor' value so the gate is actually enforced; and restrict network access to the SIP web interface by binding it to localhost or placing it behind a firewall/VPN and allowlisting only trusted management hosts (this blocks the unauthenticated network path but may break remote operation). To mitigate the CSRF path, avoid browsing untrusted sites in a session authenticated to SIP and, where possible, run the interface on an isolated management network. Consult the ZeroScience advisory (https://www.zeroscience.mk/#/advisories/ZSL-2026-5999) for exploit specifics when validating mitigations.