CVE-2025-63432

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.

• CWE-599

• https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432Third Party Advisory
• https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/Exploit, Third Party Advisory

Published

Nov 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6342A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-63420CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML inj…4.1
• CVE-2025-63421An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0…7.8
• CVE-2025-63422Incorrect access control in the Web management interface in …7.5
• CVE-2025-63423Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRou…7.5
• CVE-2025-6343A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-63433Xtooltech Xtool AnyScan Android Application 4.40.40 and prio…4.6
• CVE-2025-63434The update mechanism in Xtooltech Xtool AnyScan Android Appl…8.8
• CVE-2025-63435Xtooltech Xtool AnyScan Android Application 4.40.40 is Missi…4.3
• CVE-2025-6344A vulnerability has been found in code-projects Online Shoe …9.8
• CVE-2025-63441Open Source Social Network (OSSN) 8.6 is vulnerable to Cross…7.3
• CVE-2025-63442Simple User Management System with PHP-MySQL v1.0 is vulnera…4.6