CVE-2026-19422

{
  "etk_id": "ETK-2026-4271",
  "cve_id": "CVE-2026-19422",
  "display_id": "CVE-2026-19422",
  "ghsa_id": "GHSA-rxpq-3c54-wv69",
  "euvd_id": "EUVD-2026-124368",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in DDI Central synchronization APIs",
  "summary": "DDI Central versions earlier than 6301 do not properly authenticate requests to Windows DNS and DHCP agent synchronization APIs. An unauthenticated attacker able to reach these interfaces may impersonate an enrolled Windows server and make unauthorized DNS or DHCP changes.",
  "mitigation": "Upgrade DDI Central to version 6301 or later. Until the upgrade is complete, restrict access to the Windows DNS and DHCP agent synchronization interfaces to trusted management systems.",
  "vendor": "Zohocorp",
  "product": "DDI Central",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 6301"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6301"
      ],
      "package_name": "DDI Central",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 73.17506856666667,
  "t0_at": "2026-11-12T12:16:50.068000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T12:16:50.068000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T12:16:50.068000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19422"
    }
  }
}