PT-2025-47946 · Xtooltech · Xtool Anyscan

Published 2025-11-24 · Updated 2025-12-01 · CVE-2025-63432

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xtooltech Xtool AnyScan Android Application versions 4.40.40 and prior

Description The Xtooltech Xtool AnyScan Android Application does not properly validate TLS certificates from its update server. This allows an attacker on the same network to perform a Man-in-the-Middle (MITM) attack, intercepting, decrypting, and modifying traffic between the application and the update server. This can lead to further attacks, including Remote Code Execution.

Recommendations Update the Xtooltech Xtool AnyScan Android Application to a version newer than 4.40.40.

Exploit

Fix

RCE

Weakness Enumeration

CWE-599

Related Identifiers

CVE-2025-63432

Affected Products

Xtool Anyscan

References · 8

• 🔥 https://nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles · Exploit
• 🔥 https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432 · Exploit
• https://osv.dev/vulnerability/CVE-2025-63432 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63432 · Security Note
• https://t.me/CVEtracker/38099 · Telegram Post
• https://twitter.com/CVEnew/status/1993000818287452488 · Twitter Post
• https://twitter.com/dailycve/status/1995491324070678844 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993099800376377758 · Twitter Post