Is there a public PoC exploit available for CVE-2026-15494?

Yes, a public proof-of-concept exploit is available for CVE-2026-15494. Prioritise patching immediately. EPSS: 0.2%.

Hotel Broadband Operation System CVE-2026-15494

Q: What is the CVSS score of CVE-2026-15494?

CVE-2026-15494 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43216 LOW

SQL Injection (CWE-89)

2026-07-12 VulDB

GHSA-hf74-9683-932h

PHP SQLi Hotel Broadband Operation System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-reachable endpoint requires high-privilege credentials (PR:H); scope unchanged as impact confined to application database (S:U); low partial impact across CIA triad.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 11:30 vuln.today

Severity Changed

Jul 12, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 11:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in AMTT Hotel Broadband Operation System 1.0 exposes the manager/network/switch_status.php endpoint to database manipulation via an unsanitized ID parameter, exploitable by authenticated remote attackers. A public proof-of-concept exploit exists (GitHub issue referenced in VulDB entry), though the vulnerability is not listed in CISA KEV. The CVSS 4.0 score of 2.0 reflects the high-privilege authentication barrier (PR:H) that significantly constrains real-world attack surface, limiting this primarily to insider threat or post-compromise escalation scenarios within hotel network management environments.

Technical ContextAI

The affected component is a PHP script (manager/network/switch_status.php) belonging to AMTT's Hotel Broadband Operation System, a niche network management platform used in hospitality environments to manage guest broadband access and switch infrastructure. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), meaning user-supplied input in the ID parameter is concatenated directly into a SQL query without parameterization or sufficient escaping. The CPE string cpe:2.3:a:amtt:hotel_broadband_operation_system:*:*:*:*:*:*:*:* covers all versions of the product, though the disclosure specifically references version 1.0. The CVSS 4.0 vector confirms network reachability (AV:N) and no attack complexity barriers (AC:L, AT:N), but requires high-privilege credentials (PR:H), suggesting the vulnerable endpoint sits behind an authenticated management interface rather than being publicly exposed.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure attempts, and no patched version is referenced in any available advisory or reference. As a primary compensating control, access to the manager/network/switch_status.php endpoint should be restricted to trusted internal IP ranges via firewall or web server ACLs, reducing the network-accessible attack surface (trade-off: may disrupt legitimate remote administration). Deploying a Web Application Firewall (WAF) with SQL injection detection rules targeting the ID parameter can block known exploit patterns, though sophisticated injection techniques may evade signature-based detection. Rotating all management credentials and enforcing multi-factor authentication on the management interface reduces the impact of PR:H exploitation by raising the bar for credential compromise. Until a vendor patch is released, monitoring the management interface for anomalous SQL-pattern traffic via the ID parameter is advisable. See https://vuldb.com/vuln/377801 for ongoing disclosure tracking.