SecuriTricks - CVE-2025-63434

Description

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.

Product(s) Impacted

Vendor	Product	Versions
Xtooltech	Xtool Anyscan	4.40.40, <4.40.40

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	xtooltech	xtool_anyscan	4.40.40	/	/	/	/	/	/	/
a	xtooltech	xtool_anyscan	<4.40.40	/	/	/	/	/	/	/

References

https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63434

https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/

CVSS Score

8.8 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: Nov. 24, 2025, 5:16 p.m.
Last Modified: Nov. 25, 2025, 10:16 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2025-63434