High severity8.8NVD Advisory· Published Nov 24, 2025· Updated Jun 17, 2026
CVE-2025-63434
CVE-2025-63434
Description
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Xtooltech Xtool/AnyScan Android Applicationdescription
- Range: <=4.40.40
Patches
Vulnerability mechanics
References
2- www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/nvdExploitThird Party Advisory
- github.com/ab3lson/cve-references/tree/master/CVE-2025-63434nvdThird Party Advisory
News mentions
0No linked articles in our index yet.