CVE-2025-63435

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function

Medium · published November 24, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00363 · 28.9th percentile
Published
2025-11-24T00:00Z
EPSS history
Timeline
  • 24 NOV 00:00Z
    Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function
    cvelistv5