CVE-2020-37104

8.7 highEPSS 0.6%

High (8.7) in inextrix astpp. EPSS 0.6% chance of exploitation in the next 30 days.

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-538
Published: 2026-02-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

inextrix:astpp

References

https://github.com/iNextrix/ASTPP
https://www.astppbilling.org/
https://www.exploit-db.com/exploits/47900
https://www.vulncheck.com/advisories/astpp-voip-billing-database-backup-download

Check your stack JSON