CVE-2026-58479CWE-78command-injection

CVE-2026-58479

Critical · published July 14, 2026

CVSS v3.1
9.8
EPSS
4%
Percentile
91.3
In the wild
Unconfirmed
What it is

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04404 · 91.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-14T19:17Z
Affected products (1)
ProductVersionsFixed in
dan-in-ca/sustainable_irrigation_platform≤ 5.2.16—
References (2)
https://www.vulncheck.com/advisories/sustainable-irrigation-platform-rce-via-cli-control-plugin-command-injection · [email protected]https://www.zeroscience.mk/#/advisories/ZSL-2026-5999 · [email protected]
EPSS history
Timeline
  • 14 JUL 14:44Z
    Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection
    cvelistv5