CVE-2026-58479

Name of the Vulnerable Software and Affected Versions Sustainable Irrigation Platform (SIP) versions prior to 5.2.17

Description An issue exists in the optional cli control plugin that allows unauthenticated attackers or those using cross-site request forgery to execute arbitrary operating-system commands. This is achieved by storing a malicious payload via the plugin's HTTP endpoint. Execution is triggered when the associated irrigation station is activated, exploiting the lack of passphrase protection or the use of the default passphrase opendoor to run commands on the host.

Recommendations Update Sustainable Irrigation Platform (SIP) to version 5.2.17 or later. As a temporary mitigation, disable the cli control plugin.