Vulnerability · Published Feb 11, 2026 · Assigned by VulnCheck
CVE-2020-37104ASTPP 4.0.1 VoIP Billing - Database Backup Download
High 7.5
In plain English
A high-severity security flaw in ASTPP from ASTPP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.
Affected products (as reported)
Weakness: CWE-538 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-47900 exploit
- ASTPP Official Vendor Homepage product
- ASTPP GitHub Repository product
- VulnCheck Advisory: ASTPP 4.0.1 VoIP Billing - Database Backup Download third-party-advisory