← Retour aux CVEs

CVE-2020-37153

CRITICAL

9.8

Description

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/11/2026

Derniere modification2/20/2026

Sourcenvd

Observations honeypot0

Produits affectes

inextrix:astpp

Faiblesses (CWE)

CWE-79

References

https://github.com/iNextrix/ASTPP(disclosure@vulncheck.com)

https://www.astppbilling.org/(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/47889(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.