Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Zohocorp | DDI Central | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Nov 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers. | |
| Title | Authenticated Command Injection | |
| First Time appeared |
Zohocorp
Zohocorp ddi Central |
|
| Weaknesses | CWE-77 | |
| CPEs | cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Zohocorp
Zohocorp ddi Central |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Zohocorp
Published:
Updated: 2026-11-10T11:22:34.589Z
Reserved: 2026-06-18T05:18:33.646Z
Link: CVE-2026-12573
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses