Technical impact
This vulnerability in ManageEngine DDI Central arises from insufficient input validation that allows an authenticated user to inject arbitrary PowerShell commands during the Windows DNS SPF/TXT record push operation. The flaw is catalogued as CWE‑20. An attacker who can log into DDI Central can supply malicious input that is passed directly to a PowerShell process without sanitization, enabling execution of arbitrary code with the privileges of the DDI Central service. The impact is the potential for full remote code execution on the underlying Windows server.
Affected Systems
The affected systems are Zohocorp ManageEngine DDI Central deployments running any version earlier than 6201. These versions lack the input sanitization that protects against PowerShell command injection during DNS record pushes.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity with remote code execution as the goal. The attack vector is inferred from the title, indicating that the vulnerability requires an authenticated user with valid credentials to the DDI Central management console. Because the vulnerability requires authenticated access, the attack vector is not network‑only but relies on an attacker with valid credentials. The EPSS score is 5%, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, the combination of high impact and authenticated access means that the risk remains significant, especially for environments where DDI Central is exposed to untrusted users or where privileged accounts are weakly protected.
