PT-2025-37564 · Avtech · Avtech Eagleeyes+2

Shinycolumn · Published 2025-09-15 · Updated 2025-10-17 · CVE-2025-46408

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVTECH EagleEyes version 2.0.0

Description An issue was discovered in the GetHttpsResponse method of push.lite.avtech.com.AvtechLib and the getNewHttpClient method of push.lite.avtech.com.Push HttpService. These methods set ALLOW ALL HOSTNAME VERIFIER, bypassing domain validation.

Recommendations Update AVTECH EagleEyes to a newer version that addresses this issue. As a temporary workaround, consider disabling the use of the GetHttpsResponse and getNewHttpClient methods until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2025-46408

Affected Products

Avtech Eagleeyes

Avtechlib

Push Httpservice

References · 5

• 🔥 https://github.com/shinyColumn/CVE-2025-46408 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46408 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46408 · Vendor Advisory
• https://twitter.com/CVEnew/status/1967597843377737903 · Twitter Post
• https://t.me/cveNotify/139143 · Telegram Post