Cpe:2.3:a:zohocorp:manageengine_ddi_central:*:*:*:*:*:*:*:*

Zohocorp ManageEngine DDI Central is affected by an authorization bypass and PowerShell command injection vulnerability that allows authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands via crafted DNS suffix values.

ManageEngine DDI Central versions below 6301 are affected by an authorization bypass vulnerability allowing authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.

Zohocorp ManageEngine DDI Central versions below 6301 are affected by an improper authorization vulnerability that allows authenticated non-administrative users to delete DNS zones outside their assigned scope.

An authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs allows unauthenticated users to impersonate onboarded Windows servers and perform unauthorized modifications.