CVE-2025-3983

Deeper analysis

A vulnerability has been identified in AMTT Hotel Broadband Operation System version 1.0, specifically in the file /manager/system/nlog_down.php. The issue stems from improper handling of the ProtocolType argument, which permits command injection and is tracked under CWE-74 and CWE-77. The flaw is remotely exploitable and has been assigned a CVSS 4.0 score of 5.1; the vendor was notified prior to disclosure but did not respond.

An authenticated remote attacker with administrative privileges can supply crafted input to the affected parameter and execute arbitrary commands on the underlying system. Public exploit code has been released, and the disclosure notes that additional parameters in the same file may also be susceptible to similar manipulation.

No official patches or mitigation guidance have been issued by the vendor. Public references consist of a proof-of-concept on GitHub and entries on VulDB that document the command-injection vector without providing remediation steps.

The associated EPSS score rose from a low baseline to a peak of 0.0388 on 2026-02-23 before receding to its current value of 0.0095, indicating a period of increased exploitation interest after the initial disclosure.