Vulnerability Description
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xtooltech | Xtool Anyscan | <= 4.40.40 |
Related Weaknesses (CWE)
References
- https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63434Third Party Advisory
- https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtExploitThird Party Advisory
FAQ
What is CVE-2025-63434?
CVE-2025-63434 is a vulnerability with a CVSS score of 8.8 (HIGH). The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing ...
How severe is CVE-2025-63434?
CVE-2025-63434 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-63434?
Check the references section above for vendor advisories and patch information. Affected products include: Xtooltech Xtool Anyscan.