EUVD-2026-43687
GHSA-9xpx-72mq-c8x9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed SIP restore endpoint
-
DeliveryCraft JSON backup with traversal keys
-
ExploitUpload using default/empty 'opendoor' passphrase
-
ExecutionRestore writes file outside data dir
-
ImpactOverwrite arbitrary JSON, compromise integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the SIP JSON backup restore feature and that the instance uses the default backup passphrase state - either no passphrase configured or the hardcoded default 'opendoor' - which is the shipped default and enables unauthenticated abuse (consistent with PR:N). The concrete prerequisite is the ability to upload a crafted JSON backup whose keys embed path-traversal sequences that the restore code uses unvalidated to build file paths. The impact is write-only (VI:H, VC:N/VA:N), so it plants/overwrites JSON files rather than directly reading data or crashing the service. The principal limiting factor is configuration hardening: an administrator who has set a strong, non-default passphrase removes the unauthenticated path and forces the attacker to first obtain that passphrase, materially reducing real-world exposure. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VI:H, VC:N/VA:N, score 8.7) describes a network-reachable, low-complexity, unauthenticated write-only impact - integrity high, no confidentiality or availability impact - which is internally consistent with a path-traversal file-write flaw. PR:N is credible given the default missing/hardcoded 'opendoor' passphrase, but note the description also says the attacker needs 'access to the restore functionality', so in hardened deployments where a strong passphrase was set, effective privilege requirements rise and real-world risk drops. A public POC exists (Zero Science ZSL-2026-5996, VulnCheck), which raises practical risk, but no EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, so there is no evidence of active or automated mass exploitation at this time. Net: a genuine, easily weaponizable write primitive against default installs, but the affected product's niche footprint tempers overall priority versus a ubiquitous product with the same flaw. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed SIP instance running the default configuration, then submits a crafted JSON backup file to the restore functionality using key names containing directory-traversal sequences. Because the default passphrase is empty or 'opendoor', the restore proceeds without valid credentials and writes an attacker-controlled JSON file to an arbitrary location on disk. A public POC (Zero Science ZSL-2026-5996) demonstrates the technique, and given AV:N/AC:L this requires only a single crafted HTTP upload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Arbitrary file write in Sustainable Irrigation Platform (SIP) through 5.2.16 lets remote attackers plant JSON files outside the intended data directory by abusing the JSON backup-restore feature, which builds file paths from attacker-controlled keys without validation. Because the default deployment ships with no required passphrase (or the hardcoded default 'opendoor'), an attacker can reach the restore endpoint without legitimate credentials. Publicly available exploit code exists (VulnCheck / Zero Science advisory), and EPSS/KEV data were not provided, so exploitation appears proof-of-concept rather than confirmed in-the-wild.
RemediationAI
No fixed version was included in the supplied data, so treat this as No vendor-released patch identified at time of analysis and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/sustainable-irrigation-platform-path-traversal-via-json-backup-restore) and Zero Science advisory (https://www.zeroscience.mk/#/advisories/ZSL-2026-5996) for an upgrade beyond 5.2.16. As immediate compensating controls, set a strong, non-default backup passphrase to replace the empty/'opendoor' default (this alone removes the unauthenticated path but does not fix the traversal for those who know the passphrase), restrict network access to the restore/backup endpoint via firewall rules or a reverse-proxy allowlist so only trusted administrative hosts can reach it, and place the application behind authentication and off the public internet. Where feasible, run the service under a low-privileged account with a read-only or tightly scoped filesystem so a successful traversal cannot overwrite sensitive files outside the data directory; the trade-off is that overly strict filesystem permissions may break legitimate backup restores and require testing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SIP is a web-based irrigation management application (CPE cpe:2.3:a:dan-in-ca:sip). The flaw is a classic CWE-22 path traversal (Improper Limitation of a Pathname to a Restricted Directory): the restore routine deserializes an uploaded JSON backup and uses the object's keys directly as filesystem path components. Because those keys are neither sanitized nor constrained to the data directory, traversal sequences (e.g. ../) let the write operation escape the intended folder. The weakness is compounded by an authentication design flaw - the backup/restore protection relies on a passphrase that is empty in the default configuration or set to the well-known default 'opendoor', so the security boundary that should gate the feature is effectively absent out of the box.
Know when Sip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable restore feature exploitable at low complexity with no auth in default config (PR:N), yielding arbitrary file write (I:H) but no confidentiality or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.
Executive ViewAI
The Sustainable Irrigation Platform (SIP) versions through 5.2.16 contain a critical arbitrary file-write vulnerability that enables unauthenticated remote attackers to plant malicious JSON files on affected servers, with publicly available exploit code in circulation. Organizations running default SIP deployments face immediate operational risk: the backup-restore feature ships without authentication or uses a hardcoded credential ('opendoor'), allowing attackers to bypass access controls entirely and potentially disrupt irrigation scheduling, data integrity, and system availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the JSON backup-restore endpoint entirely if not actively required for operations; (2) Restrict network access to the restore endpoint to a secured management VLAN or bastion host only; (3) Enforce mandatory strong authentication with a unique, non-default passphrase (minimum 20 characters); (4) Deploy host-based file-integrity monitoring to alert on unauthorized .json file creation in system directories, web root, and outside the intended /data subdirectory; (5) Configure SIP process to run with minimal file-system write permissions using principle of least privilege; (6) Implement request logging and intrusion detection rules targeting the restore endpoint for suspicious file-path patterns (e.g., directory traversal sequences, system paths).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote command injection in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets unauthenticated or CSR
Configuration tampering in the Sustainable Irrigation Platform (SIP) through version 5.2.16 lets remote unauthenticated
Cross-site request forgery in the Sustainable Irrigation Platform (SIP) through 5.2.16 lets remote attackers execute sta
Server-side request forgery in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows unauthenticated netwo
Stored cross-site scripting in Sustainable Irrigation Platform (SIP) through version 5.2.16 enables unauthenticated remo
Exploit-DB