AMTT HiBOS Command Injection RCE via server_ping.php

Published 12 mo ago 2025-10-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

7.4%

percentile 94%

Public exploits

none known

AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: total
Assessed: 12 mo ago 2025-10-22

Exploit prediction (EPSS)

7.36% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	10.0	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
CNA	4.0	10.0	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System (HiBOS)

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

amttgroup.com / · product
wooyun.laolisafe.com /bug_detail.php?wybug_id=wooyun-2016-0181444 · third-party-advisory, patch
cnvd.org.cn /flaw/show/CNVD-2021-37784 · vdb-entry
github.com /adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution · exploit
vulncheck.com /advisories/amtt-hibos-command-injection-rce-via-server-ping-php · third-party-advisory

Sources

CVE List: CVE-2016-15048
NVD: CVE-2016-15048

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary