Read the docs
TI-2016-09168 Aliases CVE-2016-15048GHSA-9q3m-rvj5-q6fv

AMTT HiBOS Command Injection RCE via server_ping.php

Priority HIGH 82CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.07357 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Anmei Century (Beijing) Technology Co., Ltd.Hotel Broadband Operation System (HiBOS)all versions—No fix listedCNA
  • Hotel Broadband Operation System (HiBOS) VendorAnmei Century (Beijing) Technology Co., Ltd. Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amttgroup:hibos:-:*:*:*:*:*:*:*not specified by NVDVulnerableAMTT
  • cpe:2.3:a:amttgroup:hibos:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMTT

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-15048
  2. 2026-10-03 Alias added: GHSA-9q3m-rvj5-q6fv

References

Exploit 2

Other 2

  • TI-2023-06088 AMTT HiBOS sql injection CVSS 3.1CRITICAL 9.8
  • TI-2025-11236 AMTT Hotel Broadband Operation System get_expiredtime.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-11996 AMTT Hotel Broadband Operation System get_firstdate.php sql injection CVSS 4.0MEDIUM 5.3
  • TI-2025-02361 AMTT Hotel Broadband Operation System port_setup.php popen os command injection CVSS 4.0MEDIUM 5.3
  • TI-2024-10239 AMTT Hotel Broadband Operation System online_status.php sql injection CVSS 4.0MEDIUM 5.3
  • TI-2024-10238 AMTT Hotel Broadband Operation System language.php cross site scripting CVSS 4.0MEDIUM 5.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences