CVE-2025-46408

CriticalCVSS 9.8/10Last modified Nov 5, 2026

Description

An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-297

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/shinyColumn/CVE-2025-46408Exploit, Third Party Advisory
https://github.com/shinyColumn/CVE-2025-46408Exploit, Third Party Advisory

Timeline

Published: Sep 15, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-464098.7Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is e CVE-2025-46419.3Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux CVE-2025-464106.1A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 a CVE-2025-464119.8A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch CVE-2025-464129.8Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication.CVE-2025-464135.3Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, CVE-2025-464148.1The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attac CVE-2025-464153.2A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.CVE-2025-464162.9The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user acc CVE-2025-464177.5The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS afte CVE-2025-464187.6Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.CVE-2025-464195.9Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.