CVE-2025-46408: Critical severity AVTECH EagleEyes vulnerability

Published Sep 15, 2025

Updated

An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.PushHttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOWALLHOSTNAMEVERIFIER, bypassing domain validation.

Affected Software

2 affected components

AVTECH EagleEyes

AVTECH Eagleeyes\(lite\) Android=2.0.0

Event History

Sep 15, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-46408?

CVE-2025-46408 has a critical severity due to its potential to bypass hostname verification, leading to man-in-the-middle attacks.

How do I fix CVE-2025-46408?

To fix CVE-2025-46408, ensure that ALLOW_ALL_HOSTNAME_VERIFIER is not used and implement proper domain validation in your application.

What software is affected by CVE-2025-46408?

CVE-2025-46408 affects AVTECH EagleEyes version 2.0.0 on Android.

What is the impact of CVE-2025-46408?

The impact of CVE-2025-46408 includes the risk of attackers intercepting data through insecure HTTPS connections.

When was CVE-2025-46408 disclosed?

CVE-2025-46408 was disclosed in 2025, highlighting a significant security issue in the AVTECH application.