{"id":"CVE-2020-37153","state":"PUBLISHED","title":"ASTPP VoIP 4.0.1 - Remote Code Execution","description":"ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation.","publishedAt":"2026-02-11T20:49:48.270Z","updatedAt":"2026-03-05T01:28:17.525Z","severity":{"score":7.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ASTPP ASTPP"],"affected":[{"vendor":"ASTPP","product":"ASTPP","versions":[{"version":"4.0.1","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/47889","https://www.astppbilling.org/","https://github.com/iNextrix/ASTPP","https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:47:27.394Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/37xxx/CVE-2020-37153.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-37153","state":"PUBLISHED","datePublished":"2026-02-11T20:49:48.270Z","dateUpdated":"2026-03-05T01:28:17.525Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-03T16:27:45.309Z"},"containers":{"cna":{"title":"ASTPP VoIP 4.0.1 - Remote Code Execution","descriptions":[{"lang":"en","value":"ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces. Attackers can exploit these flaws to inject system commands, hijack administrator sessions, and potentially execute arbitrary code with root permissions through cron task manipulation."}],"affected":[{"vendor":"ASTPP","product":"ASTPP","versions":[{"version":"4.0.1","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/47889","name":"ExploitDB-47889","tags":["exploit"]},{"url":"https://www.astppbilling.org/","name":"ASTPP Official Vendor Homepage","tags":["product"]},{"url":"https://github.com/iNextrix/ASTPP","name":"ASTPP GitHub Repository","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution","name":"VulnCheck Advisory: ASTPP VoIP 4.0.1 - Remote Code Execution","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:28:17.525Z"},"datePublic":"2019-11-18T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:inextrix:astpp:4.0.1:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Fabien AUNAY","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-11T21:48:38.387806Z","id":"CVE-2020-37153","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-11T21:49:12.844Z"}}]}}}