PT-2025-43145 · Amttgroup · Hibos

Published 2025-10-22 · Updated 2025-12-31 · CVE-2016-15048

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMTT Hotel Broadband Operation System (HiBOS) (affected versions not specified)

Description The software contains an unauthenticated command injection issue in the /manager/radius/server ping.php endpoint. The application builds a shell command using the ip parameter provided by the user and executes it without sufficient validation or sanitization. This allows an attacker to inject shell metacharacters into the ip parameter, enabling the execution of arbitrary system commands with the privileges of the web server user. As of 2025-10-14 at 04:45:53.510819 UTC, this issue has been observed being exploited in real-world attacks. The product may have been rebranded under a different name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2016-15048

Affected Products

Hibos

References · 7

• 🔥 https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21 · Exploit
• 🔥 https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-15048 · Security Note
• https://t.me/cveNotify/147316 · Telegram Post
• https://amttgroup.com · Note
• https://vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-php · Note
• https://cnvd.org.cn/flaw/show/CNVD-2021-37784 · Note