Threat Intelligence Database

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin that allows unauthenticated or cross-site request forgery attackers to execute arbitrary operating-system commands by storing a malicious payload via the plugin's HTTP endpoint. Attackers can trigger execution by activating the associated irrigation station, exploiting the absence of passphrase protection or the default passphrase 'opendoor', to achieve arbitrary command execution on the underlying host.

Dan-in-CA Sustainable Irrigation Platform (SIP) up to version 5.2.16 contains a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to make the device send arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. The vulnerability arises from lack of destination validation and the use of a default passphrase 'opendoor'.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. Attackers can trigger actions such as disabling the passphrase, rebooting the device, deleting programs, or installing plugins, with the default configuration exposing these endpoints to unauthenticated users due to no required passphrase and a default credential of 'opendoor'.

Dan-in-CA Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript by submitting malicious script payloads within program names via HTTP requests. The vulnerability arises from improper neutralization of input during web page generation, specifically due to lack of output encoding on rendered program names. Exploitation is facilitated by the absence of a required passphrase or the use of the default passphrase 'opendoor'. The CVSS 4.0 base score is 5.3, indicating medium severity.