Vulnerabilities

TI-2025-39315 CVE-2025-63435 · GHSA-xx5r-8vrj-6x6c

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for…

LOW 20

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00385 Published 2025-11-24 No fix listed CWE-306

TI-2025-39314 CVE-2025-63434 · GHSA-2chj-cxxf-fqh6

MEDIUM 40

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0033 Published 2025-11-24 No fix listed CWE-494

TI-2025-39313 CVE-2025-63433 · GHSA-j9pq-93r5-c843

LOW 21

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00206 Published 2025-11-24 No fix listed CWE-798

TI-2025-39312 CVE-2025-63432 · GHSA-qcqv-64cg-9qm4

LOW 20

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00181 Published 2025-11-24 No fix listed CWE-599