CVE-2025-2701 is a Medium severity (CVSS 6.3) OS command injection in AMTT Hotel Broadband Operation System 1.0, in /manager/network/port_setup.php. The record says the vendor did not respond, so no fix is known. Isolate the system. Treat any internet facing copy as urgent, and move its management pages behind a VPN today.
What's affected
The record lists one affected release: AMTT Hotel Broadband Operation System version 1.0. The affected code is the popen function in /manager/network/port_setup.php, and several switch related arguments reach it, named in the record as SwitchVersion, SwitchWrite, SwitchIP, SwitchIndex and SwitchState.
The record states the vendor was contacted early about the disclosure and did not respond in any way. No fixed version exists in the sources, so plan around compensating controls and not an upgrade.
The vector needs a low privilege account, which is why the score is Medium, but this is network gear management software for hotel networks, so the system can sit in a sensitive place.
How to check if you're exposed
Check whether the management interface is reachable from anywhere it should not be. From a host outside the management network, test whether the web interface answers at all:
curl -sI https://your-hibos-host/manager/ | head -5
If it answers from the internet or from guest networks, that is the first thing to fix. On the system itself, look for the file named in the record and review its access history if logs are available:
find / -name port_setup.php 2>/dev/null
Also review who holds accounts on the management interface and when they last signed in. Command injection in network management code can affect the switches it controls, so check switch configuration against a known good copy.
What to do now
- Find every AMTT HiBOS installation and its network exposure.
- Remove internet access to the management interface. Place it on a management network behind a VPN.
- Restrict access to the
/manager/paths to named administrator addresses. - Review user accounts on the system and remove any that are not needed. Change passwords.
- Compare switch and network configuration to a trusted backup and look for unexpected changes.
- Ask the vendor again for a fix, and plan a replacement if none is offered.
Why it matters
The record lists CWE-77 and CWE-78: command injection and OS command injection. The program builds a system command from input and runs it, so characters in the input can add commands of their own. popen starts a shell command and reads its output, which is why unfiltered input there is dangerous.
The scored impact is low in each area because the vector requires a login, but the effect of command execution on an appliance can be much larger than the number suggests. The record says the exploit has been disclosed publicly. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
With a silent vendor, the defense is architecture: keep management planes private, limit accounts, and watch the device. Treat such a product as a candidate for replacement.
Quick check
Is a patch available?
The record says the vendor did not respond. No fixed version is named, so use network controls and plan a replacement.
Why is a Medium score still a concern?
Because the flaw is command execution on a network management system. The score reflects the login requirement and low scored impact, but real impact depends on what the device controls.
Sources
Last reviewed: 19 October 2026.
