Vulnerability · Published Jul 14, 2026 · Assigned by VulnCheck

CVE-2026-58479Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection

Critical 9.8

In plain English

A critical-severity OS command injection in SIP from Dan-in-CA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)4.4%top 8.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.

Affected products (as reported)

Vendor	Product	Versions
Dan-in-CA	SIP	0 – through 5.2.16

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Zero Science Lab Advisory (ZSL-2026-5999) technical-description, exploit
https://www.vulncheck.com/advisories/sustainable-irrigation-platform-rce-via-cli-control-plugin-command-injection third-party-advisory