The Sustainable Irrigation Platform (SIP) by Dan-in-CA through version 5.2.16 suffers from an improper control of dynamically-determined object attributes, specifically a mass assignment vulnerability. This flaw allows unauthenticated attackers to manipulate HTTP request parameters to overwrite sensitive configuration values, including passphrase and listening port settings. Additionally, the absence of adequate request validation permits exploitation through cross-site request forgery (CSRF). The vulnerability is publicly known as CVE-2026-58477 with a CVSS 4.0 score of 8.8, indicating high severity. No vendor advisory or patch information is available at this time, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

An attacker can remotely and without authentication overwrite sensitive configuration parameters of the SIP system, potentially compromising system security and availability. The ability to change critical settings such as passphrase and listening port could lead to unauthorized access or denial of service. The vulnerability also allows exploitation via CSRF, increasing the attack surface. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected SIP instances, implementing network-level protections, and monitoring for unusual configuration changes. Since the vulnerability allows unauthenticated parameter manipulation and CSRF, applying web application firewalls or similar controls may help mitigate risk.