shinycolumn/cve-2025-50944Improper Certificate Chain Validation in EagleEyes Lite Android Application
EagleEyes Lite (version 2.0.0) fails to properly validate SSL/TLS server certificates during HTTPS communication.
The application implements a custom X509TrustManager in push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted() that only checks certificate expiration and omits complete certificate chain validation.
As a result, attackers can exploit this weakness to perform MITM attacks using self-signed or rogue certificates, leading to interception and manipulation of sensitive surveillance data.
Through custom X509TrustManager, the application only verifies the expiration date of the certificate and does not validate whether the certificate chain is properly trusted.
@Override // javax.net.ssl.X509TrustManager
public void checkServerTrusted(X509Certificate[] x509CertificateArr, String str) throws CertificateException {
try {
x509CertificateArr[0].checkValidity();
} catch (Exception unused) {
throw new CertificateException("Certificate not valid or trusted.");
}
}
Through custom X509TrustManager, the application only verifies the expiration date of the certificate and does not validate whether the certificate chain is properly trusted.
This enables a MITM attacker to easily intercept or modify sensitive communications between the application and its backend server.
The application should replace the custom X509TrustManager with the default system implementation that validates the full certificate chain. Proper hostname verification must be enforced to prevent accepting mismatched or untrusted certificates.
Insecure fallback logic for legacy Android versions should be removed or updated with equivalent security checks to ensure consistent TLS validation.