← Vulnerability feed

Vulnerability record · CVE-2020-37104 · published 11 February 2026

CVE-2020-37104: Inextrix astpp vulnerability

Inextrix · Astpp

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

8.7 CVSS 4.0 High EPSS 0.59% · top 54.1% CWE-538 · CWE-538
8.7CVSS 4.0 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/iNextrix/ASTPP Product
https://www.astppbilling.org/ Product
https://www.exploit-db.com/exploits/47900 ExploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/astpp-voip-billing-database-backup-download Third Party Advisory

Track CVE-2020-37104 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.7CVE-2020-37153Inextrix astpp cross-site scripting vulnerabilityASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management …EPSS 4.6%7.5CVE-2019-15075Inextrix astpp broken cryptographic algorithm vulnerabilityAn issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demons…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2020-37104), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.