Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a CSRF flaw that allows remote attackers to force an authenticated administrator to issue HTTP GET requests without CSRF token or origin check. Attackers can trigger state‑changing actions such as disabling the device passphrase, rebooting, deleting installed programs or adding plugins. Because the default configuration exposes these endpoints to unauthenticated users—no passphrase is required and the default credential is "opendoor"—the impact is elevated if default credentials are left unchanged. The vulnerability compromises the integrity and availability of the irrigation system by enabling unauthorized administrative control through a social‑engineering attack.

The affected product is Sustainable Irrigation Platform (SIP) version 5.2.16 and earlier releases distributed by Dan‑in‑CA. All deployments running these versions are susceptible; no patched version is mentioned in the advisory.

The vulnerability has a CVSS score of 7, indicating high severity. The EPSS score is below 1%, suggesting low current exploitation likelihood, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator to visit a malicious page, so it relies on phishing or social engineering. However, the presence of default credentials and unauthenticated endpoints raises the risk in environments that have not updated or secured their installations.