Sustainable Irrigation Platform EUVD-2026-43690

Exploitation requires that the optional cli_control plugin is installed and enabled, and that its passphrase protection is either absent or left at the default value 'opendoor' - under those conditions no valid credentials are needed (PR:N). The stored payload does not execute immediately: the attack requirement (AT:P in the CVSS 4.0 vector) is that the associated irrigation station must be activated to trigger command execution, which an attacker can induce or wait for on an operational system. The network path is unauthenticated; the alternative CSRF path requires an authenticated operator to be tricked into visiting an attacker-controlled page (user interaction for that variant only). Limiting factors that reduce real-world exposure: the cli_control plugin is optional and not part of a default SIP install, operators who have set a non-default strong passphrase are protected, and the SIP interface is frequently deployed on private/home LANs rather than the public internet.

This is a genuine high-priority issue rather than a paper-tiger high score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, 9.2) indicates network-reachable, low-complexity, unauthenticated exploitation with full confidentiality/integrity/availability impact on the vulnerable system; the AT:P (Attack Requirement: Present) metric correctly reflects that the injected command only fires when the associated irrigation station is activated, a modest gating condition an attacker can often influence or simply wait out. Publicly available exploit code (ZeroScience ZSL-2026-5999, corroborated by VulnCheck) raises real-world likelihood, and the CSRF vector means an authenticated operator merely visiting a hostile page could unknowingly plant the payload. Tempering factors: the product is a niche hobbyist/open-source controller with limited enterprise footprint, the cli_control plugin is optional and not enabled by default, and the flaw is not in CISA KEV, suggesting no confirmed mass exploitation yet. No EPSS score was provided in the input, so probabilistic exploitation frequency cannot be quantified here - the risk case rests on POC availability plus a trivial default-credential/no-credential path.

An attacker sends a crafted HTTP request to the cli_control plugin endpoint of an internet- or LAN-reachable SIP instance, using the empty or default 'opendoor' passphrase to store a shell command payload; alternatively they lure an authenticated operator to a malicious web page that submits the same request via CSRF. When the associated irrigation station is next activated, SIP passes the stored payload to the OS shell and the attacker's command runs on the host. A public POC (ZeroScience ZSL-2026-5999) is available, and the low attack complexity makes this straightforward against default configurations.