# CVE-2026-58477: Dan-in-CA SIP mass assignment in configuration settings

Source: https://junglewise.ai/threats/cve-2026-58477-dan-in-ca-sip-mass-assignment-in-configuration-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-58477 · Severity: high · CVSS 8.2 · Published 2026-07-14

The Sustainable Irrigation Platform (SIP), a system used for managing irrigation infrastructure, contains a security flaw that allows unauthorized individuals to change critical system settings. By sending specially crafted web requests, an attacker could modify the device's password or change the communication ports it uses to listen for commands. This could lead to a complete loss of control over the irrigation system, potential service outages, or unauthorized access to the management interface.

Technologies: [Dan-in-CA Sustainable Irrigation Platform](https://junglewise.ai/threats/technologies/sustainable-irrigation-platform). Vendors: [Dan-in-CA](https://junglewise.ai/threats/vendors/dan-in-ca).

## Quick answers

**Is CVE-2026-58477 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58477 being exploited in the wild.

**How severe is CVE-2026-58477?** High severity, with a CVSS score of 8.2, published 14 July 2026.

**Which products and versions are affected?** Dan-in-CA Sustainable Irrigation Platform through 5.2.16.

**Is there a fix for CVE-2026-58477?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58477 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58477?** Check whether you run Dan-in-CA Sustainable Irrigation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A mass assignment vulnerability (CWE-915) exists in the Sustainable Irrigation Platform (SIP) through version 5.2.16. The application fails to properly filter or restrict HTTP parameters, allowing unauthenticated remote attackers to overwrite sensitive internal configuration attributes by supplying arbitrary parameter names in HTTP requests. Specifically, attackers can manipulate critical values such as the system passphrase and the service listening port. Additionally, the lack of adequate request validation makes the system susceptible to achieving the same result via Cross-Site Request Forgery (CSRF). As of the advisory date, no specific patch version has been confirmed, though the vulnerability is documented through version 5.2.16.

## Affected products

- Dan-in-CA SIP (Sustainable Irrigation Platform) through 5.2.16

## Timeline

- 2026-07-14: advisory: Initial disclosure by VulnCheck and Zero Science Lab
- 2026-07-14: disclosed: CVE-2026-58477 published to NVD

## References

- [https://www.vulncheck.com/advisories/sustainable-irrigation-platform-mass-assignment-via-http-parameters](https://www.vulncheck.com/advisories/sustainable-irrigation-platform-mass-assignment-via-http-parameters)
- [https://www.zeroscience.mk/](https://www.zeroscience.mk/)

## Related threats

- [Dan-in-CA SIP path traversal in JSON backup restore](https://junglewise.ai/threats/cve-2026-60114-dan-in-ca-sip-path-traversal-in-json-backup-restore)
- [Dan-in-CA Sustainable Irrigation Platform command injection in cli_control plugin](https://junglewise.ai/threats/cve-2026-58479-dan-in-ca-sustainable-irrigation-platform-command-injection-in)
- [Dan-in-CA Sustainable Irrigation Platform CSRF in administrative endpoints](https://junglewise.ai/threats/cve-2026-58476-dan-in-ca-sustainable-irrigation-platform-csrf-in-administrative)
- [Dan-in-CA Sustainable Irrigation Platform stored XSS in program names](https://junglewise.ai/threats/cve-2026-58475-dan-in-ca-sustainable-irrigation-platform-stored-xss-in-program)