CVE-2025-46408

CriticalCVSS 9.8

Published: 15/09/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.66%

52th percentile - higher than 52% of all known CVEs

Summary

An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.

Risk Assessment

Bypassing hostname validation may allow an attacker to perform a man-in-the-middle attack and intercept or modify communications. This can lead to breach of data confidentiality and integrity.

Recommendation

Update AVTECH EagleEyes to a version that fixes the vulnerability, if available. Until then, avoid transmitting sensitive data through the application.

Other vulnerabilities in AVTECH EagleEyes

CVE-2025-50944High
An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used in checkServerTrusted only checks the certificate's expiration date, skipping proper TLS chain validation.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS