CVE-2020-37104
Published: 11 February 2026
Summary
CVE-2020-37104 is a high-severity Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) vulnerability in Inextrix Astpp. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations.
Monitors for sensitive information placed in externally accessible files or directories.
The map shows if data actions result in sensitive information being placed in externally accessible locations.
Isolation and eradication reduce the ability to exploit sensitive information inserted into externally-accessible files or directories.
Approved categorization forces identification of externally accessible files that contain sensitive content so they receive proper protection.
The pre-implementation review identifies externally accessible files or directories containing PII and drives access restrictions or removal.
Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories.
OPSEC practices stop placement of supply-chain information into locations accessible to external parties.
NVD Description
ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database…
more
information from the /database_backup/ directory.
Deeper analysisAI
ASTPP 4.0.1, a VoIP billing software, is affected by CVE-2020-37104, an information disclosure vulnerability rated at CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and mapped to CWE-538. The flaw enables unauthenticated attackers to download database backup files from the /database_backup/ directory by predicting backup filename patterns, which incorporate 6-digit PIN combinations.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no privileges required. By generating a list of possible 6-digit PINs and fuzzing the backup download URL, they can exfiltrate sensitive database information contained in the backups.
Advisories and references, including those from Vulncheck and Exploit-DB, detail the issue and provide exploit code demonstrating the attack. Security practitioners should consult the ASTPP GitHub repository and official site for any available patches or configuration guidance to mitigate exposure of the /database_backup/ directory.
A proof-of-concept exploit is publicly available on Exploit-DB, indicating potential for real-world abuse against unpatched ASTPP 4.0.1 deployments.
Details
- CWE(s)