CVE-2020-37104 - CVE House
Back to Database
Status published High CVE-2020-37104

ASTPP 4.0.1 VoIP Billing - Database Backup Download

Vulnerability Description

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-37104

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Fabien AUNAY

References

More from ASTPP

View All →
CVE-2020-37153
ASTPP VoIP 4.0.1 - Remote Code Execution
High 7.7

Affected Vendor

Affected Software

ASTPP
Vulnerable Versions:
4.0.1

Timeline

Official Publish: February 11th, 2026
Last Modified: March 5th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-538

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.