CVE-2026-58478 is an SSRF vulnerability in Dan-in-CA SIP versions up to 5.2.16. When the optional Node-RED plugin is installed, unauthenticated attackers can exploit the absence of destination validation and the default passphrase 'opendoor' to cause the device to issue arbitrary HTTP requests to internal or external hosts that may not be directly accessible otherwise. This enables attackers to potentially interact with internal network resources or external systems via the vulnerable device acting as a proxy.

The vulnerability allows unauthenticated attackers to make the device perform arbitrary HTTP requests, potentially accessing internal or external network resources that are otherwise inaccessible. This could lead to information disclosure or further network reconnaissance. However, no direct code execution or data modification impact is described. The CVSS 4.0 base score is 6.3, indicating a medium severity impact.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling the optional Node-RED plugin or changing the default passphrase 'opendoor' may reduce exposure. Monitor vendor communications for updates and apply official fixes once released.