EUVD-2026-43683
GHSA-5j3h-8rxj-3v3m
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Cross-site request forgery in the Sustainable Irrigation Platform (SIP) through 5.2.16 lets remote attackers execute state-changing administrative actions when a logged-in administrator is lured to a malicious page, because administrative endpoints accept HTTP GET requests with no CSRF token or origin validation. An attacker can disable the passphrase, reboot the irrigation controller, delete watering programs, or install plugins; in the default configuration these endpoints are exposed to unauthenticated users because no passphrase is required and the default credential is 'opendoor'. Publicly available exploit code exists (ZeroScience ZSL-2026-5995), though there is no public exploit identified as being used in active campaigns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Sip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. Attackers can trigger actions such as disabling the passphrase, rebooting the device, deleting programs, or installing plugins, with the default configuration exposing these endpoints to unauthenticated users due to no required passphrase and a default credential of 'opendoor'.
Executive ViewAI
The Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery (CSRF) vulnerability that enables remote attackers to execute state-changing administrative actions-including disabling security controls, deleting watering programs, installing plugins, and rebooting controllers. With publicly available exploit code and default configurations exposing endpoints without authentication, organizations running SIP face immediate operational disruption and potential loss of control over critical infrastructure.
Within 24 hours, identify all SIP deployments running version 5.2.16 or earlier and document network exposure; immediately change the default credential from 'opendoor' to a strong unique passphrase and isolate SIP instances from untrusted networks and the public internet. Within 7 days, implement firewall rules restricting SIP administrative access to designated networks only, enable detailed logging and alerting for administrative endpoint access, and conduct targeted phishing awareness training for SIP administrators. Within 30 days, monitor vendor advisories for patch release; in parallel, evaluate alternative irrigation control platforms and engage the SIP vendor or project to understand remediation timeline, as no vendor-released patch is currently identified at this time.
Network isolation: restrict SIP access to hardened administrative networks only, with firewall allowlisting of trusted IP ranges. Credentials: immediately replace the default 'opendoor' credential with a strong unique passphrase and disable legacy default accounts. Access controls: require multi-factor authentication for SIP administration if supported; disable HTTP GET for state-changing operations where possible. Monitoring: enable comprehensive logging of administrative endpoint access and alert on anomalous administrative actions. Staff training: conduct phishing awareness training targeting SIP admin accounts. Note: these mitigations reduce attack surface but do not eliminate CSRF risk-patching upon vendor release remains mandatory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Remote command injection in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets unauthenticated or CSR
Configuration tampering in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets remote unauthenticated
Arbitrary file write in Sustainable Irrigation Platform (SIP) through 5.2.16 lets remote attackers plant JSON files outs
Server-side request forgery in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows unauthenticated netwo
Stored cross-site scripting in Sustainable Irrigation Platform (SIP) through version 5.2.16 enables unauthenticated remo
Exploit-DB