CVE-2016-15048: Amttgroup Hibos command injection (CVSS 9.8)

Description

AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Amttgroup Hibosall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21Product
https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444ExploitIssue TrackingThird Party Advisory
https://www.amttgroup.com/Product
https://www.cnvd.org.cn/flaw/show/CNVD-2021-37784Issue Tracking
https://www.vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-phpThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2016-15048 being actively exploited?

CVE-2016-15048 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 7.36%.

How severe is CVE-2016-15048?

CVE-2016-15048 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 7.36% probability of exploitation.

Which products are affected by CVE-2016-15048?

Affected products include Amttgroup Hibos.

How do I fix CVE-2016-15048?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-15048 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo