What is CVE-2016-15048?

CVE-2016-15048 is a critical-severity vulnerability in Amttgroup Hibos, classified under OS Command Injection. CVSS score: 9.8/10. Published 2025-10-22.

How severe is CVE-2016-15048?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Amttgroup Hibos

CVE-2016-15048

AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.

Vulnerability class: Command Injection (OS Command Injection)

Published 2025-10-22 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.074 (94.2th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.074 · newest: 0.074 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

www.amttgroup.com/ (Product, product)
wooyun.laolisafe.com/bug_detail.php (Exploit, Third Party Advisory, patch, Issue Tracking, third-party-advisory)
www.cnvd.org.cn/flaw/show/CNVD-2021-37784 (vdb-entry, Issue Tracking)
github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/… (Product, exploit)
www.vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-p… (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2016-15048?: CVE-2016-15048 is a critical-severity vulnerability in Amttgroup Hibos, classified under OS Command Injection. CVSS score: 9.8/10. Published 2025-10-22.
How severe is CVE-2016-15048?: Critical severity. CVSS v3 base score is 9.8 out of 10.