CVE-2020-37153 - Vulnerability Analysis

Overview

ASTPP 4.0.1 contains command injection and stored XSS vulnerabilities in SIP device configuration and plugin management interfaces, letting attackers execute arbitrary code with root permissions and hijack admin sessions, exploit requires access to these interfaces.

Severity & Score

Impact

Attackers can execute arbitrary code as root and hijack administrator sessions, leading to full system compromise.

Mitigation

Update to the latest version of ASTPP.

References

• https://www.astppbilling.org/
• https://www.exploit-db.com/exploits/47889
• https://www.vulncheck.com/advisories/astpp-voip-remote-code-execution
• https://github.com/iNextrix/ASTPP

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner