Medium severity4.6NVD Advisory· Published Nov 24, 2025· Updated Jun 17, 2026
CVE-2025-63433
CVE-2025-63433
Description
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, allowing them to direct the application to download a malicious update package.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:xtooltech:xtool_anyscan:*:*:*:*:*:android:*:*+ 1 more
- cpe:2.3:a:xtooltech:xtool_anyscan:*:*:*:*:*:android:*:*range: <=4.40.40
- (no CPE)range: <=4.40.40
Patches
Vulnerability mechanics
References
2- www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/nvdExploitThird Party Advisory
- github.com/ab3lson/cve-references/tree/master/CVE-2025-63433nvdThird Party Advisory
News mentions
0No linked articles in our index yet.