CVE-2025-46408

In the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient, the application sets the ALLOW_ALL_HOSTNAME_VERIFIER flag, which completely disables domain verification when establishing HTTPS connections. This means the application will accept any TLS certificate regardless of whether the hostname on the certificate matches the actual server. An attacker on the same network (e.g., public Wi-Fi) can substitute their own TLS server and intercept communication between the application and the target push server without detection by the user.

An attacker can conduct a Man-in-the-Middle attack, gaining access to sensitive data transmitted by the application (e.g., authentication credentials, camera images) and potentially modifying communication, which threatens data confidentiality and integrity.

Apply patches available from the manufacturer according to references. Until update, it is recommended to avoid using the application on untrusted networks (public Wi-Fi, networks of unknown operators).

AVTECH EagleEyes (Lite) version 2.0.0