Sustainable Irrigation Platform EUVD-2026-43681

Exploitation of the injection phase requires the target SIP instance to accept program submissions with either no passphrase configured or the default passphrase 'opendoor' - both conditions are explicitly cited in the vulnerability description as enabling unauthenticated HTTP submission. This is the primary limiting factor: a SIP deployment configured with a unique non-default passphrase prevents unauthenticated program name submission and blocks the injection vector entirely. The stored XSS payload only executes when a legitimate user navigates to the page rendering program names, requiring passive victim interaction (CVSS UI:P); exploitation cannot be fully achieved without at least one user viewing the poisoned listing. The vulnerability does not affect server-side assets directly (VC:N/VI:N/VA:N in the CVSS 4.0 vector), constraining impact to browser-session compromise of viewing users. SIP instances not exposed to untrusted networks are not reachable by external attackers regardless of passphrase configuration.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the limited per-system impact: VC:N/VI:N/VA:N indicates the vulnerable system's server-side assets are not directly compromised, while SC:L/SI:L captures the limited but real browser-session impact on users who view the affected page. The most significant real-world amplifier is the deployment condition: SIP's default passphrase 'opendoor' or absent passphrase configuration reduces the attacker's effective barrier to zero, making the unauthenticated injection vector trivially accessible. A public POC from ZeroScience - a reputable vulnerability research firm - further lowers the skill threshold to commodity-level. The CVE is not present in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis, though the combination of default credentials and public exploit code creates meaningful opportunistic risk. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified further. Risk is moderate for internet-exposed SIP instances on default configuration, low for network-isolated or properly passphrase-protected deployments.

An attacker identifies a publicly reachable SIP instance using the default 'opendoor' passphrase, then submits an HTTP request creating a program entry whose name field contains a JavaScript payload designed to exfiltrate session cookies to an attacker-controlled server. Every legitimate operator or user who subsequently navigates to the SIP program listing page silently executes the injected script in their browser, transmitting their session identifiers to the attacker and enabling account takeover. A publicly available proof-of-concept from ZeroScience (ZSL-2026-5994) documents this precise technique, requiring no special tooling beyond a standard HTTP client.