Description
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.
Affected products
avtech: eagleeyes\(lite\)
References2
- github.com/shinyColumn/CVE-2025-46408 ExploitThird Party Advisory
- github.com/shinyColumn/CVE-2025-46408 ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 52 · as of 8 November 2026
- CWE
- CWE-297
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.