CVE-2016-15048 is a critical (CVSS 9.8) unauthenticated command injection in AMTT Hotel Broadband Operation System (HiBOS). The /manager/radius/server_ping.php endpoint builds a shell command from the ip parameter without escaping it, so commands run as the web server user. No fixed version is confirmed.
What's affected
AMTT Hotel Broadband Operation System (HiBOS), with no version range given in the record. The vulnerable endpoint is /manager/radius/server_ping.php.
The record says the application builds a shell command that includes the user-supplied ip parameter and runs it without validation or escaping, and that shell metacharacters in the value run as commands under the web server account. It also notes that the initial third party disclosure in 2016 recommended contacting the vendor for remediation guidance, and that the product may have been rebranded under a different name.
I could not confirm a fixed version. Ask AMTT directly, and check whether your copy is sold under another brand.
How to check if you're exposed
HiBOS is used by hotels and similar venues to manage guest internet access, so start with the people who run the network. Ask which product runs the guest broadband gateway, and what version.
If you manage such a system, check whether the manager interface is reachable from outside the management network:
nmap -sV -p 80,443,8080 <gateway-address>
Look for the manager path in the web server's access logs, and look for requests to the ping page from addresses that are not your staff. Review the host for unexpected processes and outbound connections.
What to do now
- Confirm whether you run HiBOS or a rebranded version of it, and which version.
- Contact AMTT for a fixed build or mitigation guidance, as the original disclosure advised.
- Block the manager interface from guest and external networks. Allow only named administrator addresses.
- Inspect the host for signs of compromise, and rebuild it if you find any.
- Segment the guest broadband system from the systems that handle payments and staff data.
Why it matters
The class is CWE-78 (OS Command Injection). A ping test page is a normal admin feature. The bug is how it is built: the address typed by the user is placed inside a shell command line, so special characters change what the shell does. Because no login is required, an outsider can reach it.
The safe pattern is to avoid the shell. Validate that the value is a legal IP address, then call the ping routine directly with arguments passed as data, not as a string to be parsed.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Is there a fixed version of HiBOS?
I could not confirm one. The record says the 2016 disclosure advised contacting the vendor.
Does an attacker need a login?
No. The record describes the endpoint as unauthenticated.
Sources
Last reviewed: 19 October 2026.
