CVE-2020-37153 | ASTPP 4.0.1 contains multiple vulnerabilities including cros… | CVSS 9.8 CRITICAL

Description

ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.

Metadata

CVE ID: CVE-2020-37153
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-03 16:27 UTC
Published: 2026-02-11 20:49 UTC
Last updated: 2026-03-05 01:28 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: ASTPP / ASTPP
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
ASTPP	ASTPP	—	4.0.1

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (4)

ExploitDB-47889 https://www.exploit-db.com/exploits/47889
ASTPP Official Vendor Homepage https://www.astppbilling.org/
ASTPP GitHub Repository https://github.com/iNextrix/ASTPP
VulnCheck Advisory: ASTPP VoIP 4.0.1 - Remote Code Execution https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution