CVE-2025-46408

CRITICAL

AVTECH EagleEyes <2.0.0 - Info Disclosure

Title source: llm

Description

An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.

Exploits (1)

nomisec WORKING POC 1 stars

by shinyColumn · poc

https://github.com/shinyColumn/CVE-2025-46408

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory] https://github.com/shinyColumn/CVE-2025-46408

Scores

CVSS v3 9.8

EPSS 0.0003

EPSS Percentile 9.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-297

Status published

Products (1)

avtech/eagleeyes\(lite\) 2.0.0

Published Sep 15, 2025

Tracked Since Feb 18, 2026