PT-2025-47947 · Xtooltech · Xtool Anyscan

Published 2025-11-24 · Updated 2025-12-01 · CVE-2025-63433

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xtooltech Xtool AnyScan Android Application versions 4.40.40 and prior

Description The Xtooltech Xtool AnyScan Android Application utilizes a hardcoded cryptographic key and Initialization Vector (IV) for decrypting update metadata. This key is embedded as a static value within the application’s code. An attacker intercepting network traffic can exploit this to decrypt, modify, and re-encrypt the update manifest, potentially directing the application to download and install a malicious update package.

Recommendations Update to a newer version of Xtooltech Xtool AnyScan Android Application that does not use the hardcoded cryptographic key.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-63433

Affected Products

Xtool Anyscan

References · 8

• 🔥 https://nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles · Exploit
• 🔥 https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63433 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63433 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63433 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1993102360432828780 · Twitter Post
• https://twitter.com/dailycve/status/1995497473763319956 · Twitter Post
• https://t.me/CVEtracker/38100 · Telegram Post
• https://twitter.com/CVEnew/status/1993000819260608535 · Twitter Post