Security readout for executives and security teams
Plain-English summary
AMTT HiBOS, a hotel broadband management system, has a critical unauthenticated remote command execution flaw. An attacker reaching the vulnerable web endpoint can run system commands without logging in. VulnCheck reports in-the-wild exploitation. Business urgency is highest for hotels or managed networks still running HiBOS or a rebranded version exposed to untrusted networks.
Executive priority
Immediate priority for any organization operating HiBOS or acquired hotel broadband infrastructure. The flaw is unauthenticated, remotely reachable, rated critical, and reportedly exploited. If the product is unsupported, replacement may be the safest business decision.
Technical view
CVE-2016-15048 is CWE-78 command injection in /manager/radius/server_ping.php. The ip parameter is placed into a shell command without proper validation or escaping, allowing arbitrary command execution as the web server user. CVSS v4.0 is 10.0. Affected version detail is incomplete, and the product may have been rebranded.
Likely exposure
Exposure is likely where HiBOS management interfaces are reachable from the internet, guest networks, or other untrusted networks. Risk may be hidden by product rebranding. Organizations outside hospitality may be exposed if they inherited AMTT HiBOS in managed broadband environments.
Exploitation context
VulnCheck states it observed exploitation in the wild as of 2025-10-14. The source bundle also references public proof-of-concept material. No KEV listing is provided. Treat reachable instances as high-risk until verified isolated, remediated, or removed.
Researcher notes
Evidence supports command injection and RCE, but affected version information is sparse. The original 2016 disclosure reportedly advised contacting the vendor. Avoid assuming a patch exists. Rebranding creates discovery risk; validate by product behavior, paths, and vendor artifacts, not name alone.
Mitigation direction
- Identify any AMTT HiBOS or rebranded deployments immediately.
- Remove public or guest-network access to the HiBOS management interface.
- Restrict access to trusted administrative networks only.
- Contact the vendor or maintainer for remediation guidance.
- Replace or retire unsupported systems if no vendor fix is available.
- Monitor web logs for suspicious server_ping.php ip parameter activity.
Validation and detection
- Search asset inventory for AMTT, HiBOS, and hotel broadband management systems.
- Check external attack surface for exposed HiBOS management portals.
- Review web access logs for requests to /manager/radius/server_ping.php.
- Look for unusual characters or command-like content in the ip parameter.
- Confirm whether the deployment is vendor-supported or rebranded.
- Document network reachability from internet, guest, and internal segments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2016-15048 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
10CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.amttgroup.com/CVE reference · product
- https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444CVE reference · third-party-advisory, patch
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-37784CVE reference · vdb-entry
- https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21CVE reference · exploit
- https://www.vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-phpCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.