CVE-2025-63434: Xtooltech Xtool Anyscan

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.

Affected products

• Xtooltech Xtool Anyscan: up to and including 4.40.40

Published 2025-11-24. Last modified 2026-06-17.