CVE-2025-46408

An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2025-09-15

Last modified

2025-09-17

Weaknesses

CWE-297

Affected products

• Eagleeyes(lite) (Avtech)

References

• https://github.com/shinyColumn/CVE-2025-46408