CVE-2025-63432

Name of the Vulnerable Software and Affected Versions Xtooltech Xtool AnyScan Android Application versions 4.40.40 and prior

Description The Xtooltech Xtool AnyScan Android Application does not properly validate TLS certificates from its update server. This allows an attacker on the same network to perform a Man-in-the-Middle (MITM) attack, intercepting, decrypting, and modifying traffic between the application and the update server. This can lead to further attacks, including Remote Code Execution.

Recommendations Update the Xtooltech Xtool AnyScan Android Application to a version newer than 4.40.40.