CVE-2026-58479
Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection
Vexday Risk Score
45Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS 9.2EPSS —KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
14 Jul 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Dan-in-CA · SIPpublic PoCs found — 1
cve_referencewww.zeroscience.mk/#/advisories/ZSL-2026-5999unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.