CVE-2020-37153

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-37153
ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/iNextrix/ASTPP Product
https://www.astppbilling.org/ Product
https://www.exploit-db.com/exploits/47889 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:inextrix:astpp:4.0.1:*:*:*:*:*:*:*
History

20 Feb 2026, 20:22

Type Values Removed Values Added
CPE cpe:2.3:a:inextrix:astpp:4.0.1:*:*:*:*:*:*:*
First Time Inextrix astpp
Inextrix
Summary
  • (es) ASTPP 4.0.1 contiene múltiples vulnerabilidades, incluyendo cross-site scripting e inyección de comandos en las interfaces de configuración de dispositivos SIP y gestión de plugins. Los atacantes pueden explotar estas fallas para inyectar comandos del sistema, secuestrar sesiones de administrador y, potencialmente, ejecutar código arbitrario con permisos de root mediante la manipulación de tareas cron.
References () https://github.com/iNextrix/ASTPP - () https://github.com/iNextrix/ASTPP - Product
References () https://www.astppbilling.org/ - () https://www.astppbilling.org/ - Product
References () https://www.exploit-db.com/exploits/47889 - () https://www.exploit-db.com/exploits/47889 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution - () https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution - Third Party Advisory

11 Feb 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-11 21:16

Updated : 2026-02-20 20:22

NVD link : CVE-2020-37153

Mitre link : CVE-2020-37153

CVE.ORG link : CVE-2020-37153

JSON object : View

Products Affected

inextrix

  • astpp
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')