CVE-2026-12573 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine DDI Central versions 6200 and below pass a DHCP pool name into Cisco IOS configuration without sanitising it. An attacker who can set that name can run arbitrary commands on the Cisco routers the product manages.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running ManageEngine DDI Central 6200 or earlier that use it to manage Cisco IOS routers. The sources do not say what role or configuration an attacker needs to set the DHCP pool name.
Not affected if not-cisco-managed
Who cares cisco-ios, ddi-central, dhcp, manageengine
6200; the sources do not name the fixed version.Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.