CVE-2020-37104: Inextrix Astpp

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database information from the /database_backup/ directory.

Affected products

• Inextrix Astpp: version 4.0.1 only

Published 2026-02-11. Last modified 2026-06-17.