CVE-2020-37153

7.7 highEPSS 5.0%

High (7.7) in inextrix astpp. EPSS 5.0% chance of exploitation in the next 30 days.

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.

Severity

CVSS 4.0

7.7 high

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.0% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-02-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

inextrix:astpp

References

https://github.com/iNextrix/ASTPP
https://www.astppbilling.org/
https://www.exploit-db.com/exploits/47889
https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution

Check your stack JSON