PT-2026-7668 · Astpp+1 · Astpp

Fabien Aunay · CVE-2020-37104 · Published 2026-02-11 · Updated 2026-02-11

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASTPP version 4.0.1

Description An information disclosure issue exists that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and attempt to access the backup download URL to exfiltrate sensitive database information from the /database backup/ directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2020-37104

Affected Products

Astpp

References · 6

• 🔥 https://exploit-db.com/exploits/47900 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37104 · Security Note
• https://osv.dev/vulnerability/CVE-2020-37104 · Vendor Advisory
• https://github.com/iNextrix/ASTPP · Note
• https://vulncheck.com/advisories/astpp-voip-billing-database-backup-download · Note
• https://astppbilling.org · Note