Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Xtooltech records in CISA KEVNo Xtooltech vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 40
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0033 · Published 2025-11-24 · No fix listed CWE-494
Priority LOW 21
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00206 · Published 2025-11-24 · No fix listed CWE-798
Priority LOW 20
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00385 · Published 2025-11-24 · No fix listed CWE-306
Priority LOW 20
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00181 · Published 2025-11-24 · No fix listed CWE-599
THREATIST.IORead the docs