Sustainable Irrigation Platform versions up to 5.2.16 contain an OS command injection flaw in the optional cli_control plugin. The plugin exposes an HTTP endpoint that accepts a payload and stores it without proper input validation. When an irrigation station is activated, the stored payload is executed as an operating‑system command, granting the attacker arbitrary command execution on the host. This vulnerability belongs to CWE‑78.

All deployments of Dan‑in‑CA's Sustainable Irrigation Platform running version 5.2.16 are affected. The flaw exists regardless of whether the platform is exposed to the public internet or an internal network, because the vulnerable HTTP endpoint is reachable by any party that can contact the system. Earlier releases do not contain this vulnerability, and no patch has been released for them.

The CVSS score of 9.2 classifies the flaw as critical. The EPSS score of 3% indicates a moderate likelihood that attackers will exploit it. Attackers can activate the flaw by sending a malicious request to store a payload via the cli_control endpoint. The lack of passphrase protection or default passphrase 'opendoor' allows this to be performed unauthenticated or via cross‑site request forgery. Once executed, the attacker gains full control over the underlying operating system. The vulnerability is not yet listed in CISA's KEV catalog. Based on the description, the likely attack vector is inferred to be an unauthenticated HTTP request to the plugin’s endpoint, requiring network access to the plugin’s HTTP endpoint to launch the exploit. The CVE description does not specify the operating systems affected or the exact nature of the commands that can be executed, so those details are missing.