Domain Validation Bypass in AVTECH EagleEyes 2.0.0
CVE-2025-46408

9.8CRITICAL

Key Information:

Vendor

AVTECH

Status
EagleEyes
Vendor
CVE Published:
15 September 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-46408?

A flaw has been identified in the AVTECH EagleEyes 2.0.0 application, specifically within the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient. This vulnerability allows the application to set ALLOW_ALL_HOSTNAME_VERIFIER, which effectively bypasses hostname verification during HTTPS requests. As a result, the application may unwittingly connect to malicious servers, compromising the integrity and confidentiality of the data transmitted.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-46408
Created by shinyColumn

References

https://github.com/shinyColumn/CVE-2025-46408

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

JSON
.
CVE-2025-46408 : Domain Validation Bypass in AVTECH EagleEyes 2.0.0