Domain Validation Bypass in AVTECH EagleEyes 2.0.0
CVE-2025-46408
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-46408?
A flaw has been identified in the AVTECH EagleEyes 2.0.0 application, specifically within the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient. This vulnerability allows the application to set ALLOW_ALL_HOSTNAME_VERIFIER, which effectively bypasses hostname verification during HTTPS requests. As a result, the application may unwittingly connect to malicious servers, compromising the integrity and confidentiality of the data transmitted.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.