CVE-2026-58476 describes a CSRF vulnerability in Dan-in-CA SIP up to version 5.2.16. The platform fails to validate CSRF tokens or verify request origins for certain administrative HTTP GET endpoints. Consequently, an attacker can lure an authenticated administrator to a malicious site that issues crafted requests, causing unauthorized state-changing operations. The default configuration lacks a required passphrase and uses a default credential 'opendoor', which further lowers the barrier for exploitation. No official patch or remediation level has been published as of the data provided.

Successful exploitation allows remote attackers to perform critical administrative actions without authentication or user intent confirmation. This includes disabling security controls like passphrases, rebooting the device, deleting irrigation programs, or installing unauthorized plugins. The vulnerability thus compromises device availability, integrity of configuration, and overall security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to change default credentials immediately and restrict access to administrative interfaces. Additionally, administrators should avoid visiting untrusted websites while logged into the SIP management interface to reduce CSRF risk.