{"id":"CVE-2026-12573","kind":"vulnerability","aliases":["CVE-2026-12573"],"related":[],"title":"ManageEngine DDI Central: DHCP pool name injects commands into managed Cisco routers","description":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.","summary":"ManageEngine DDI Central versions 6200 and below pass a DHCP pool name into Cisco IOS configuration without sanitising it. An attacker who can set that name can run arbitrary commands on the Cisco routers the product manages.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco-ios","ddi-central","dhcp","manageengine","vendor"],"not_affected_if":["not-cisco-managed"],"how_to_check":"- Check the installed DDI Central version against the affected range (6200 and below).","fix":"- Move to a DDI Central release newer than `6200`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:28+00:00","updated_at":"2026-11-10T12:22:28+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T12:22:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a DDI Central release newer than `6200`; the sources do not name the fixed version.","reach":"network","title":"ManageEngine DDI Central: DHCP pool name injects commands into managed Cisco routers","impact":"high","summary":"ManageEngine DDI Central versions 6200 and below pass a DHCP pool name into Cisco IOS configuration without sanitising it. An attacker who can set that name can run arbitrary commands on the Cisco routers the product manages.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","cisco-ios","dhcp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary commands run on managed Cisco routers","analyst_note":"Confirm the fixed DDI Central version and whether an authenticated user is needed to set a DHCP pool name, using the NVD entry and Zoho's advisory.","how_to_check":"- Check the installed DDI Central version against the affected range (6200 and below).\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-cisco-managed"],"who_is_affected":"Organisations running ManageEngine DDI Central 6200 or earlier that use it to manage Cisco IOS routers. The sources do not say what role or configuration an attacker needs to set the DHCP pool name.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4533,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-12573':15A,18A '-2026':14A,17A '6200':32B,71C 'arbitrari':56B,87C 'attack':48B 'central':3A,24B,30B,69C 'cisco':11A,20B,41B,60B,77C,91C 'cisco-io':19B 'command':8A,57B,79C,88C 'configur':43B 'corpor':66C 'cve':13A,16A 'ddi':2A,23B,29B,68C 'ddi-centr':22B 'dhcp':4A,25B,37B,82C 'inject':7A,80C 'io':21B,42B,78C 'lead':85C 'manag':10A,64B,90C 'manageengin':1A,26B,28B,67C 'name':6A,39B,53B,84C 'pass':35B 'pool':5A,38B,83C 'product':63B 'router':12A,61B,92C 'run':55B 'sanitis':45B 'set':51B 'vendor':27B 'version':31B,70C 'via':81C 'vulner':75C 'without':44B 'zoho':65C","nicknames":[],"mitigations":[],"who_affected":"Organisations running ManageEngine DDI Central 6200 or earlier that use it to manage Cisco IOS routers. The sources do not say what role or configuration an attacker needs to set the DHCP pool name.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ciscoios","ddicentral","dhcp","high","manageengine","vendor"],"campaign_type":null,"search_a":"'-12573':15A,18A '-2026':14A,17A 'central':3A 'cisco':11A 'command':8A 'cve':13A,16A 'ddi':2A 'dhcp':4A 'inject':7A 'manag':10A 'manageengin':1A 'name':6A 'pool':5A 'router':12A","search_b":"'6200':32B 'arbitrari':56B 'attack':48B 'central':24B,30B 'cisco':20B,41B,60B 'cisco-io':19B 'command':57B 'configur':43B 'ddi':23B,29B 'ddi-centr':22B 'dhcp':25B,37B 'io':21B,42B 'manag':64B 'manageengin':26B,28B 'name':39B,53B 'pass':35B 'pool':38B 'product':63B 'router':61B 'run':55B 'sanitis':45B 'set':51B 'vendor':27B 'version':31B 'without':44B","search_c":"'6200':71C 'arbitrari':87C 'central':69C 'cisco':77C,91C 'command':79C,88C 'corpor':66C 'ddi':68C 'dhcp':82C 'inject':80C 'io':78C 'lead':85C 'manag':90C 'manageengin':67C 'name':84C 'pool':83C 'router':92C 'version':70C 'via':81C 'vulner':75C 'zoho':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12573","severity":null,"published_at":"2026-11-10T12:17:19+00:00","modified_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}