Zohocorp ManageEngine DDI Central versions prior to build 6201 contain a Keepalived configuration injection flaw in the high‑availability workflow. The vulnerability requires an authenticated operator‑level user and allows the attacker to alter the Keepalived configuration file. Because Keepalived runs with elevated privileges, a crafted configuration can lead to arbitrary command execution as root on the DDI Central host, effectively giving the attacker full control of the affected machine.

The issue affects Zohocorp DDI Central version 6.2.0 build numbers below 6201. Administrators should verify if their deployment runs any of these builds.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not publicly available, suggesting limited public exploitation data. The vulnerability is not listed in CISA KEV. Exploitation requires local or network access to an operator‑level account, meaning privilege escalation from an authenticated user to root is the primary attack vector. Given the high impact and lack of published exploitation, the risk remains high for any existing systems that have not applied the fix.