CVE-2026-58476CWE-352

Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests

High · published July 14, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. Attackers can trigger actions such as disabling the passphrase, rebooting the device, deleting programs, or installing plugins, with the default configuration exposing these endpoints to unauthenticated users due to no required passphrase and a default credential of 'opendoor'.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00271 · 18.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-07-14T14:25Z
EPSS history
Timeline
  • 14 JUL 14:25Z
    Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests
    cvelistv5