An SQL injection vulnerability (CVE-2026-15494) affects AMTT Hotel Broadband Operation System 1.0. The issue arises from improper sanitization of the ID parameter in a function located in file manager/network/switch_status.php, allowing remote attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. The vendor was contacted but did not provide any response or fix. No official patch or mitigation guidance is available at this time.

Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks remotely, potentially leading to unauthorized access or manipulation of the backend database. The exact impact depends on the database and application context but may include data disclosure, modification, or other database-related impacts. The CVSS score indicates a medium severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level protections such as restricting access to the vulnerable component and monitoring for suspicious activity targeting the ID parameter. Avoid exposing the affected interface to untrusted networks until a fix is released.