CVE-2016-15048

High PUBLISHED

AMTT HiBOS Command Injection RCE via server_ping.php

Anmei Century (Beijing) Technology Co., Ltd. · Hotel Broadband Operation System (HiBOS)

Not yet in CISA KEV

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

10.0 Critical EPSS 7.2%

At a Glance

AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.

CVE Published: Oct 22, 2025
Exploitation Reported: Jun 01, 2026
CVSS: 10.0 Critical
EPSS: 7.2%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Anmei Century (Beijing) Technology Co., Ltd.	Hotel Broadband Operation System (HiBOS)	0	Affected

CVE References

Patch — wooyun.laolisafe.com wooyun.laolisafe.com · Patch https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444
Third-Party Advisory — vulncheck.com vulncheck.com · Third-Party Advisory https://www.vulncheck.com/advisories/amtt-hibos-command-injection-rce...
GitHub — adysec/nuclei_poc github.com · Exploit https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768...
VDB Entry — cnvd.org.cn cnvd.org.cn · VDB Entry https://www.cnvd.org.cn/flaw/show/CNVD-2021-37784
Product — amttgroup.com amttgroup.com · Product https://www.amttgroup.com/

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2026-06-01 10:42 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2016-15048

{
  "cve_id": "CVE-2016-15048",
  "title": "AMTT HiBOS Command Injection RCE via server_ping.php",
  "affected_vendor": "Anmei Century (Beijing) Technology Co., Ltd.",
  "affected_product": "Hotel Broadband Operation System (HiBOS)",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 10.0,
  "epss_score": 0.07163,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2016-15048

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Timeline

Automate This Intelligence with the Pro API