CVE-2020-37104CWE-538

ASTPP 4.0.1 VoIP Billing - Database Backup Download

High · published February 11, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00636 · 49.8th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2026-02-11T20:49Z
EPSS history
Timeline
  • 11 FEB 20:49Z
    ASTPP 4.0.1 VoIP Billing - Database Backup Download
    cvelistv5