CVE-2026-58478

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attackers can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts not otherwise directly accessible.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.vulncheck.com/advisories/sustainable-irrigation-platform-ssrf-via-node-red-callback-url	Third Party Advisory
https://www.zeroscience.mk/#/advisories/ZSL-2026-5998	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dan-in-ca:sustainable_irrigation_platform:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La Plataforma de Riego Sostenible (SIP) hasta la versión 5.2.16 contiene una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) que permite a atacantes no autenticados hacer que el dispositivo emita peticiones HTTP arbitrarias al proporcionar una URL de callback maliciosa cuando el plugin opcional Node-RED está instalado. Los atacantes pueden explotar la falta de validación de destino y la frase de contraseña predeterminada ’opendoor’ para enviar peticiones HTTP ciegas a hosts internos o externos arbitrarios que de otro modo no serían directamente accesibles.

Information

Published : 2026-07-14 15:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-58478

Mitre link : CVE-2026-58478

CVE.ORG link : CVE-2026-58478

JSON object : View

Products Affected

dan-in-ca

sustainable_irrigation_platform

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-58478", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58478", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T18:11:45.813627Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Dan-in-CA/SIP", "vendor": "Dan-in-CA", "product": "SIP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.2.16"}], "packageURL": "pkg:github/Dan-in-CA/SIP", "defaultStatus": "affected"}]}], "published": "2026-07-14T15:17:06.753", "references": [{"url": "https://www.vulncheck.com/advisories/sustainable-irrigation-platform-ssrf-via-node-red-callback-url", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.zeroscience.mk/#/advisories/ZSL-2026-5998", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attackers can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts not otherwise directly accessible."}, {"lang": "es", "value": "La Plataforma de Riego Sostenible (SIP) hasta la versi\u00f3n 5.2.16 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) que permite a atacantes no autenticados hacer que el dispositivo emita peticiones HTTP arbitrarias al proporcionar una URL de callback maliciosa cuando el plugin opcional Node-RED est\u00e1 instalado. Los atacantes pueden explotar la falta de validaci\u00f3n de destino y la frase de contrase\u00f1a predeterminada \u2019opendoor\u2019 para enviar peticiones HTTP ciegas a hosts internos o externos arbitrarios que de otro modo no ser\u00edan directamente accesibles."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dan-in-ca:sustainable_irrigation_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EE9365B-7650-4B63-83A9-8E6049CCD660", "versionEndIncluding": "5.2.16"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}