CVE-2025-63435

4.3 mediumEPSS 0.4%

Medium (4.3) in xtooltech xtool anyscan. EPSS 0.4% chance of exploitation in the next 30 days.

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-11-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xtooltech:xtool_anyscan

References

https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63435
https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/

Check your stack JSON