CVE-2025-63435

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

CVE-2025-63433

The Xtooltech Xtool AnyScan Android application (version 4.40.40 and prior ) is vulnerable to a security flaw caused by the use of a hardcoded cryptographic key and IV to decrypt update metadata. Because the key is stored as a static value within the application's code, an attacker capable of int...