A critical information disclosure vulnerability in AVTECH EagleEyes Lite 2.0.0 exposes sensitive account credentials and device tokens, posing a significant risk of unauthorized access.

The GetHttpsResponse method improperly handles sensitive data by transmitting internal server URLs, account IDs, passwords, and device tokens as plaintext query parameters. This vulnerability is accessible to an unauthenticated attacker who can intercept network traffic.

The exposure of account credentials and device tokens allows for complete account takeover and potential unauthorized control over managed security devices. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security, potentially leading to data breaches and the compromise of internal infrastructure.

Immediate Action: Since no official patch is currently available, users should restrict network access to affected devices and implement strict firewall rules to prevent unauthorized interception of traffic.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the EagleEyes Lite application and review access logs for suspicious patterns originating from the device.

Compensating Controls: Deploy a Web Application Firewall or a secure VPN tunnel to encrypt traffic and prevent the exposure of plaintext credentials during transit.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub as documented in the referenced security research.

The severity of this vulnerability necessitates immediate containment actions. Because a public proof-of-concept is available, the likelihood of exploitation is elevated. Administrators must isolate the affected software from untrusted networks and prioritize the implementation of encrypted communication channels until a vendor-supplied update is released.