CVE-2026-58479 describes an OS command injection vulnerability in Dan-in-CA's SIP product through version 5.2.16. The issue exists in the optional cli_control plugin, which exposes an HTTP endpoint that accepts input without proper neutralization of special elements. Attackers can store malicious commands and trigger their execution by activating the associated irrigation station. The vulnerability requires no privileges or user interaction and is facilitated by weak or absent passphrase protection, allowing arbitrary command execution on the host system.

Successful exploitation enables unauthenticated or CSRF attackers to execute arbitrary operating system commands on the host running the SIP product. This can lead to full system compromise, data manipulation, or disruption of irrigation operations. The CVSS 4.0 base score of 9.2 reflects the critical severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the cli_control plugin's HTTP endpoint, enforce strong passphrase protection instead of default or absent passphrases, and implement network-level controls to prevent unauthorized access. Monitor vendor channels for updates and apply official patches promptly once released.