Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2025-50944: AVTECH EagleEyes 2.0.0 Fails to Properly Validate Server Certificates
CVE-2025-50944 · published 1 year ago
Summary
AVTECH EagleEyes 2.0.0 may connect to a fake or compromised server if its certificate has not yet expired. This can allow an attacker to intercept sensitive information. To mitigate this, update to the latest version of AVTECH EagleEyes or use an external certificate validation tool.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| avtech | eagleeyes\(lite\) |
2.0.0 cpe:2.3:a:avtech:eagleeyes\(lite\):2.0.0:*:*:*:*:android:*:* |
Original advisory text
An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used in checkServerTrusted only checks the...
An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used in checkServerTrusted only checks the certificate's expiration date, skipping proper TLS chain validation.
References
- https://github.com/shinyColumn/CVE-2025-50944 Exploit Third Party Advisory
- https://shinycolumn.notion.site/eagleeyes-lite Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-295Improper Certificate Validation
Timeline
Published15 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-50944 · NVD
Track software like this
Free during beta