What is the CVSS score of CVE-2020-37104?

CVE-2020-37104 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Astpp are affected by CVE-2020-37104?

Astpp versions up to 4.0.1 contain a vulnerability that exposes sensitive information in publicly accessible files, potentially compromising customer data, credentials, or configuration details.

Is there a public PoC exploit available for CVE-2020-37104?

Yes, a public proof-of-concept exploit is available for CVE-2020-37104. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2020-37104?

Within 24 hours: Inventory all Astpp deployments and confirm version numbers; isolate affected systems from external internet access if operationally feasible. Within 7 days: Implement network-level access controls restricting external file access; enable detailed logging and monitoring for suspicious file access attempts; conduct forensic review for signs of exploitation. Within 30 days: Upgrade to Astpp 4.0.2 or later when available; perform full security assessment of exposed systems; review and rotate any potentially compromised credentials.

Astpp CVE-2020-37104

HIGH

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-02-11 disclosure@vulncheck.com

Information Disclosure Astpp Inextrix

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 20, 2026 - 20:20 vuln.today

Public exploit code

CVE Published

Feb 11, 2026 - 21:16 nvd

HIGH 7.5

DescriptionCVE.org

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

AnalysisAI

Astpp versions up to 4.0.1 is affected by insertion of sensitive information into externally-accessible file (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-538: Insertion of Sensitive Information into Externally-Accessible File) affects Astpp. ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.