CVE-2025-63435 – Xtooltech Xtool AnyScan Authentication Bypass Vulnerability

CVE ID : CVE-2025-63435

Published : Nov. 24, 2025, 5:16 p.m. | 2 hours, 6 minutes ago

Description : Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…