CVE-2026-58478: medium-severity vulnerability in Dan-in-CA SIP
Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.3epss 0.4%
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attackers can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts not otherwise directly accessible.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Dan-in-CA · SIPpublic PoCs found — 1
cve_referencewww.zeroscience.mk/#/advisories/ZSL-2026-5998unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Dan-in-CA SIP
In the same product, most dangerous first.
CVE-2026-58479CRITICALSustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command InjectionEPSS 4.4%CVE-2026-58477HIGHSustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP ParametersEPSS 0.5%CVE-2026-60114HIGHSustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup RestoreEPSS 0.5%CVE-2026-58475MEDIUMSustainable Irrigation Platform 5.2.16 Stored XSS via Program NameEPSS 0.3%CVE-2026-58476HIGHSustainable Irrigation Platform 5.2.16 CSRF via Administrative GET RequestsEPSS 0.3%