CVE-2025-63435

The Xtooltech Xtool AnyScan Android Application version 4.40.40 is vulnerable to Missing Authentication for Critical Function (CWE-306). The root cause is a server-side endpoint responsible for serving update packages that does not require any authentication. This flaw allows an unauthenticated r...

CVE-2025-63433

The Xtooltech Xtool AnyScan Android Application (version 4.40.40 and prior) is vulnerable to a security flaw caused by the use of a hardcoded cryptographic key and IV to decrypt update metadata. Because this key is stored as a static value within the application's code, an attacker capable of int...

CVE-2025-63434

The Xtooltech Xtool AnyScan Android Application (version 4.40.40 and prior ) contains an insecure update mechanism. The application downloads and extracts update packages containing executable code without performing cryptographic integrity or authenticity checks . An attacker capable of controll...

CVE-2025-63432

The Xtooltech Xtool AnyScan Android Application (version 4.40.40 and prior ) is vulnerable to a Man-in-the-Middle (MITM) attack due to Missing SSL Certificate Validation . The application fails to properly validate the TLS certificate from its update server, allowing an attacker on the same netwo...