CVE-2026-58475: Dan-in-ca SIP XSS Vulnerability

CVE-2026-58475 Overview

CVE-2026-58475 is a stored cross-site scripting (XSS) vulnerability affecting the Dan-in-ca Sustainable Irrigation Platform (SIP) through version 5.2.16. Unauthenticated attackers can inject arbitrary JavaScript by supplying malicious script payloads within program names submitted through HTTP requests. The application fails to apply output encoding when rendering program names, allowing the injected payload to execute in the browser of any user viewing the affected page. Exploitation is facilitated by the absence of a required passphrase or reliance on the default passphrase opendoor. The weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can persistently inject JavaScript into program names, enabling session theft, UI manipulation, and further client-side attacks against SIP operators.

Affected Products

Dan-in-ca Sustainable Irrigation Platform (SIP) versions up to and including 5.2.16
Deployments running without a configured passphrase
Deployments using the default passphrase opendoor

Discovery Timeline

2026-07-14 - CVE-2026-58475 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-58475

Vulnerability Analysis

The Sustainable Irrigation Platform accepts user-supplied program names through HTTP requests and stores them for later display. When SIP renders program listings, it embeds the stored value directly into the HTML response without contextual output encoding. An attacker who submits a program name containing HTML or JavaScript markup causes the browser to interpret that markup as executable content. Because the attack vector is network-based and requires no prior authentication, any reachable SIP instance can be seeded with a malicious payload. The stored nature of the flaw means every subsequent visitor to the affected page executes the injected script within the SIP application origin.

Root Cause

The root cause is missing output encoding on the program-name field during HTML rendering, combined with weak access controls on the write path. SIP does not enforce a mandatory passphrase for program creation, and installations that retain the default value opendoor provide no meaningful barrier. Together, these design choices convert a common input handling defect into an unauthenticated stored XSS.

Attack Vector

An attacker sends an HTTP request to the SIP endpoint that accepts program definitions and supplies a program name containing a JavaScript payload. Once the record is stored, any operator or administrator loading the program list executes the payload in their session. The attacker can steal session tokens, pivot to authenticated actions such as modifying irrigation schedules, or redirect users to attacker-controlled infrastructure. Public technical details are available in the VulnCheck Security Advisory and ZeroScience Advisory ZSL-2026-5994.

Detection Methods for CVE-2026-58475

Indicators of Compromise

Program name records containing HTML tags such as <script>, <img onerror=, or <svg onload= when queried from SIP storage.
Unexpected outbound requests from operator browsers to unfamiliar domains shortly after loading SIP program pages.
HTTP POST requests to SIP program-creation endpoints from unknown source addresses without a valid non-default passphrase.

Detection Strategies

Inspect stored program-name fields for any characters outside a strict allowlist such as letters, digits, spaces, hyphens, and underscores.
Review web server or reverse-proxy logs for POST requests containing URL-encoded <, >, or script tokens targeting SIP endpoints.
Correlate operator browser telemetry with SIP page loads to identify script execution from the SIP origin that contacts external hosts.

Monitoring Recommendations

Enable HTTP request logging on the SIP host and forward logs to a centralized analytics platform for pattern matching.
Alert on any authentication or configuration change events that follow a program-name update, indicating potential session hijacking.
Monitor for use of the default passphrase opendoor in configuration files and flag installations that have not rotated it.

How to Mitigate CVE-2026-58475

Immediate Actions Required

Restrict network access to the SIP web interface using firewall rules or a VPN so it is not reachable from untrusted networks.
Replace the default passphrase opendoor with a strong, unique value on every SIP deployment.
Audit existing program-name records and remove entries containing HTML or JavaScript markup.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Operators should monitor the VulnCheck Security Advisory and ZeroScience Advisory ZSL-2026-5994 for vendor updates beyond version 5.2.16.

Workarounds

Place SIP behind a reverse proxy that strips or escapes HTML metacharacters in program-name parameters before they reach the application.
Deploy a Content Security Policy that disallows inline scripts on SIP responses to reduce the impact of stored payloads.
Limit administrative access to a small set of trusted source IP addresses and require passphrase authentication for all write operations.

bash

# Configuration example: nginx reverse proxy filter blocking obvious XSS payloads in SIP program-name parameter
location / {
    if ($args ~* "(<|%3C)\s*script") {
        return 403;
    }
    if ($request_body ~* "(<|%3C)\s*script") {
        return 403;
    }
    proxy_pass http://sip_backend;
}