CVE-2026-95646: Authenticated Command Injection
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs cluster-scoped operator privileges in ManageEngine DDI Central and access to the Cisco IOS DHCP configuration functionality. The issue is therefore not described as exploitable by unauthenticated or low-privileged users.
What input is required to trigger the issue?
The attacker must submit specially crafted Unicode characters through the affected Cisco IOS DHCP configuration workflow. Successful exploitation can cause unintended commands to execute on the device.
Which deployments should be considered affected?
ManageEngine DDI Central version 6500 and earlier should be considered affected when they use the Cisco IOS DHCP configuration functionality and grant cluster-scoped operator access. The provided information does not state whether the functionality is enabled by default.
What is the immediate mitigation if patching cannot be performed?
Restrict cluster-scoped operator privileges and limit access to the Cisco IOS DHCP configuration functionality to trusted administrators. Review configuration changes submitted through that functionality for specially crafted Unicode input.