CVE-2025-50944

HighCVSS 8.8

Published: 15/09/2025(UTC)Updated: 08/11/2026(UTC)Translated: 08/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used in checkServerTrusted only checks the certificate's expiration date, skipping proper TLS chain validation.

Risk Assessment

The application accepts untrusted or forged certificates, enabling an attacker to intercept and modify communications (man-in-the-middle attack).

Recommendation

Update AVTECH EagleEyes to a version with fixed certificate validation or apply a patch enforcing full TLS chain verification.

Other vulnerabilities in AVTECH EagleEyes

CVE-2025-46408Critical
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS