CVE-2026-58478

Name of the Vulnerable Software and Affected Versions Sustainable Irrigation Platform (SIP) versions prior to 5.2.17

Description A server-side request forgery (SSRF) issue exists when the optional Node-RED plugin is installed. Unauthenticated attackers can force the device to issue arbitrary blind HTTP requests to internal or external hosts by providing a malicious callback URL. This is possible due to a lack of destination validation and the use of the default passphrase opendoor.

Recommendations Update Sustainable Irrigation Platform (SIP) to version 5.2.17 or later. Change the default passphrase opendoor to a secure one. Disable the Node-RED plugin if it is not required.