{"id":"CVE-2026-95646","kind":"vulnerability","aliases":["CVE-2026-95646"],"related":[],"title":"ManageEngine DDI Central: Unicode input lets operators inject device commands","description":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.","summary":"ManageEngine DDI Central versions 6500 and below contain a Unicode-based command injection flaw in its Cisco IOS DHCP configuration feature. An authenticated cluster-scoped operator can inject crafted Unicode characters that cause unintended commands to run on managed devices.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DDI Central","fixed":["build 6500"],"affected":"<= 6.3.0 (build 6300)","ecosystem":"vendor"}],"ecosystems":[],"tags":["cisco-ios","command-injection","ddi-central","dhcp","manageengine","unicode","vendor"],"not_affected_if":["build-6500-or-later","no-cisco-ios-dhcp-management","version-above-6500"],"how_to_check":"Check the DDI Central build in the console. Builds 6300 (6.3.0) and below are affected; 6500 is fixed. Exposed only if you manage Cisco IOS devices through DDI Central's DHCP configuration and have operators with DHCP edit permission on a cluster containing a Cisco device. Also check for stored DHCP pool client_name values containing U+2028.","fix":"Update DDI Central to build 6500 or later via the service pack.","status":"open","published_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:21:57+00:00","updated_at":"2026-11-10T11:22:38+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-10T11:21:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ManageEngine DDI Central: Unicode input lets operators inject device commands","impact":"high","summary":"ManageEngine DDI Central versions 6500 and below contain a Unicode-based command injection flaw in its Cisco IOS DHCP configuration feature. An authenticated cluster-scoped operator can inject crafted Unicode characters that cause unintended commands to run on managed devices.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","cisco-ios","dhcp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Unintended commands execute on managed network devices","analyst_note":"Confirm the fixed version and whether the Cisco IOS DHCP feature must be enabled, using the vendor advisory for CVE-2026-95646.","how_to_check":"- Check the installed DDI Central version against the affected range (6500 and below).\n- unknown for any further check; the sources do not say which configuration enables the Cisco IOS DHCP feature.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-above-6500"],"who_is_affected":"Teams that run ManageEngine DDI Central, version 6500 or below, and use its Cisco IOS DHCP configuration feature. The flaw is reached by cluster-scoped operators, so exposure depends on who holds those roles. The sources do not say whether other deployments are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":4575,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the Cisco IOS DHCP feature must be enabled, using the vendor advisory for CVE-2026-95646.","search":"'-2026':12A,15A '-95646':13A,16A '6500':36B,80C 'allow':103C 'authent':55B 'base':43B,89C 'caus':66B 'central':3A,18A,27B,34B,78C 'charact':64B,113C 'cisco':20B,49B,95C 'cisco-io':19B 'cluster':57B,105C 'cluster-scop':56B,104C 'command':10A,23B,44B,68B,90C,121C 'command-inject':22B 'configur':52B,98C 'contain':39B 'corpor':75C 'could':102C 'craft':62B,111C 'cve':11A,14A 'ddi':2A,17A,26B,33B,77C 'ddi-centr':25B 'devic':9A,73B,120C 'dhcp':28B,51B,97C 'execut':117C 'featur':53B 'flaw':46B 'function':99C 'inject':8A,24B,45B,61B,91C,109C 'input':5A 'io':21B,50B,96C 'let':6A 'manag':72B 'manageengin':1A,29B,32B,76C 'oper':7A,59B,107C 'result':114C 'run':70B 'scope':58B,106C 'special':110C 'unicod':4A,30B,42B,63B,88C,112C 'unicode-bas':41B,87C 'unintend':67B,119C 'vendor':31B 'version':35B,79C 'vulner':84C,92C,101C 'zoho':74C","nicknames":[],"mitigations":[],"who_affected":"Teams running ManageEngine DDI Central build 6300 (6.3.0) or below that manage Cisco IOS devices through its DHCP configuration. An authenticated non-administrator operator with DHCP edit permission on a cluster containing a Cisco device can put a U+2028 character in the DHCP pool client_name field, and Cisco IOS treats it as a command separator, so extra commands run on that device. It does not need user interaction or access to another cluster. Installs without Cisco IOS DHCP management can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T11:22:38Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html","run_id":2442},"how_to_check":{"at":"2026-11-10T11:22:38Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html","run_id":2442},"who_affected":{"at":"2026-11-10T11:22:38Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html","run_id":2442}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["central","ddicentral"],"ptokens":["central","ddi"],"labels":["ciscoios","commandinjection","ddicentral","dhcp","high","manageengine","unicode","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95646':13A,16A 'central':3A,18A 'command':10A 'cve':11A,14A 'ddi':2A,17A 'devic':9A 'inject':8A 'input':5A 'let':6A 'manageengin':1A 'oper':7A 'unicod':4A","search_b":"'6500':36B 'authent':55B 'base':43B 'caus':66B 'central':27B,34B 'charact':64B 'cisco':20B,49B 'cisco-io':19B 'cluster':57B 'cluster-scop':56B 'command':23B,44B,68B 'command-inject':22B 'configur':52B 'contain':39B 'craft':62B 'ddi':26B,33B 'ddi-centr':25B 'devic':73B 'dhcp':28B,51B 'featur':53B 'flaw':46B 'inject':24B,45B,61B 'io':21B,50B 'manag':72B 'manageengin':29B,32B 'oper':59B 'run':70B 'scope':58B 'unicod':30B,42B,63B 'unicode-bas':41B 'unintend':67B 'vendor':31B 'version':35B","search_c":"'6500':80C 'allow':103C 'base':89C 'central':78C 'charact':113C 'cisco':95C 'cluster':105C 'cluster-scop':104C 'command':90C,121C 'configur':98C 'corpor':75C 'could':102C 'craft':111C 'ddi':77C 'devic':120C 'dhcp':97C 'execut':117C 'function':99C 'inject':91C,109C 'io':96C 'manageengin':76C 'oper':107C 'result':114C 'scope':106C 'special':110C 'unicod':88C,112C 'unicode-bas':87C 'unintend':119C 'version':79C 'vulner':84C,92C,101C 'zoho':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T11:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95646","severity":null,"published_at":"2026-11-10T11:16:43+00:00","modified_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95646:2442","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html","severity":null,"published_at":"2026-11-10T11:22:38+00:00","modified_at":"2026-11-10T11:22:38+00:00","first_seen_at":"2026-11-10T11:22:38+00:00","fetched_at":"2026-11-10T11:22:38+00:00","note":"Vendor advisory read: affected build 6300 and below (NVD's '6500 and below' is wrong, 6500 is the fix), fixed in build 6500 (Sept 17 2026). No PoC link or exploitation reported; vendor says PoC used a non-destructive command.","cites":["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html"]}],"documents":[{"id":114695,"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html","title":"ManageEngine DDI Central CVE-2026-95646","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}