CVE-2026-58476highCWE-352

CVE-2026-58476: falha de alta gravidade em Dan-in-CA SIP

Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests

Publicada em

Seguir esta CVE+ Monitorar SIP

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7epss 0.3%
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. Attackers can trigger actions such as disabling the passphrase, rebooting the device, deleting programs, or installing plugins, with the default configuration exposing these endpoints to unauthenticated users due to no required passphrase and a default credential of 'opendoor'.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Dan-in-CA · SIP
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Dan-in-CA SIP

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58479CRITICALSustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command InjectionEPSS 4.4%CVE-2026-58477HIGHSustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP ParametersEPSS 0.5%CVE-2026-60114HIGHSustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup RestoreEPSS 0.5%CVE-2026-58478MEDIUMSustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URLEPSS 0.4%CVE-2026-58475MEDIUMSustainable Irrigation Platform 5.2.16 Stored XSS via Program NameEPSS 0.3%