medium4.3
CVE-2025-63435
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function.
Impact
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xtooltech | Xtool Anyscan | through 4.40.40 |