CVE-2025-63434 – Xtooltech Xtool AnyScan Unauthenticated Remote Code Execution Vulnerability

CVE ID : CVE-2025-63434

Published : Nov. 24, 2025, 5:16 p.m. | 2 hours, 6 minutes ago

Description : The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…