Security Advisory
CVE-2025-63435
4.3
MEDIUM
Vulnerability Description
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..
Published Date
November 24, 2025
Official Source
NIST NVD Advisory