CVE-2026-58476highCWE-352

CVE-2026-58476: fallo de gravedad alta en Dan-in-CA SIP

Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests

Publicada el

Seguir esta CVE+ Monitorear SIP

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7epss 0.3%
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. Attackers can trigger actions such as disabling the passphrase, rebooting the device, deleting programs, or installing plugins, with the default configuration exposing these endpoints to unauthenticated users due to no required passphrase and a default credential of 'opendoor'.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Dan-in-CA · SIP
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Dan-in-CA SIP

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-58479CRITICALSustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command InjectionEPSS 4.4%CVE-2026-58477HIGHSustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP ParametersEPSS 0.5%CVE-2026-60114HIGHSustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup RestoreEPSS 0.5%CVE-2026-58478MEDIUMSustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URLEPSS 0.4%CVE-2026-58475MEDIUMSustainable Irrigation Platform 5.2.16 Stored XSS via Program NameEPSS 0.3%