CVE-2025-63432
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
49/100
Published: 2025-11-24
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Unchanged
C:
Low
I:
Low
A:
None
Description
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| xtooltech | xtool_anyscan | < 4.40.40 |
References & Advisories (2)
Third Party Advisory
Exploit
Third Party Advisory