VulnerabilityPublished 24 Nov 2025

CVE-2025-63433: Xtooltech Xtool AnyScan Android application · CVE-2025-63433 is a medium severity

Source CVE Database V5

Not known to be exploited · CVSS 4.6 Medium.

Data as of 26 Oct 2026, 13:47 UTC

CVSS 3.1 base score

4.6Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Monitor for official patches or updates from Xtooltech and apply them immediately once available to remove the hardcoded key vulnerability.
Until patched, restrict network environments where the app is used by enforcing VPN usage or trusted network connections to prevent interception of update traffic.
Employ network-level protections such as TLS interception detection and certificate pinning to detect or block man-in-the-middle attacks targeting update channels.
Educate users to avoid connecting to untrusted or public Wi-Fi networks when performing app updates.
Implement endpoint detection and response (EDR) solutions to monitor for suspicious behaviors indicative of malicious update execution.
Consider application-layer firewalls or mobile device management (MDM) policies to control app update mechanisms and restrict unauthorized network traffic.
Conduct regular security audits of mobile applications used within the organization to identify similar cryptographic weaknesses.
Engage with Xtooltech support to inquire about timelines for a fix and request interim mitigation guidance.

Description

CVE-2025-63433 is a medium severity vulnerability in the Xtooltech Xtool AnyScan Android application (version 4.40.40 and prior) where a hardcoded cryptographic key and IV are used to decrypt update metadata. This static key embedded in the app code allows an attacker intercepting network traffic to decrypt, modify, and re-encrypt the update manifest. Consequently, the attacker can redirect the app to download malicious update packages. Exploitation requires network interception capabilities and some user interaction but no elevated privileges. Although no known exploits are reported in the wild, the vulnerability risks integrity and confidentiality of the update process. European organizations using this app on Android devices could face targeted supply chain attacks. Mitigation involves updating the app once a patch is available and employing network security controls to prevent interception. Countries with higher Android usage and significant industrial or commercial use of Xtool AnyScan are more likely affected.

Impact

For European organizations, this vulnerability poses a risk primarily to the integrity and confidentiality of their Android devices running Xtool AnyScan. If exploited, attackers could deliver malicious updates that compromise device functionality, steal sensitive data, or establish persistent footholds within corporate networks. This is particularly concerning for sectors relying on Xtool AnyScan for diagnostics or operational technology, such as manufacturing, automotive, or critical infrastructure. The attack requires network interception capabilities, which could be feasible in public Wi-Fi environments or compromised internal networks. The potential for supply chain attacks could undermine trust in software updates and lead to broader security incidents. While availability is not directly impacted, the indirect consequences of malicious updates could include system instability or data breaches. European organizations with remote or mobile workforces using this app are at increased risk. The medium severity score suggests a moderate but actionable threat that should be addressed promptly to prevent escalation.

Summary

CVE-2025-63433 identifies a cryptographic vulnerability in the Xtooltech Xtool AnyScan Android application version 4.40.40 and earlier. The application uses a hardcoded cryptographic key and initialization vector (IV) embedded as static values within the app's code to decrypt update metadata received from the network. This design flaw violates secure coding best practices (CWE-798) by exposing sensitive cryptographic material, which should be dynamically generated or securely stored. An attacker capable of intercepting the network traffic between the app and its update server can leverage the hardcoded key and IV to decrypt the update manifest. After decryption, the attacker can modify the manifest to point the app to a malicious update package, then re-encrypt it using the same key and IV, making the tampered update appear legitimate to the app. This attack vector effectively enables supply chain compromise, allowing the attacker to inject malicious code into the app's update process. Exploitation requires network-level access (e.g., man-in-the-middle position) and user interaction to trigger the update process. The vulnerability impacts the confidentiality and integrity of the update mechanism but does not affect availability. The CVSS 3.1 base score of 4.6 reflects these factors, indicating a medium severity. No patches or exploits are currently reported, but the risk remains significant due to the potential for malicious updates. The vulnerability highlights the critical need for secure key management and encrypted update channels in mobile applications, especially those used in sensitive or industrial environments.

CWE-798Use of Hard-coded Credentials (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product contains hard-coded credentials, such as a password or cryptographic key.
Architecture and Design
For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320).
Architecture and Design
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
Architecture and Design
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
OWASP Cheat Sheets
Key Management (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.10.4 (opens in a new tab)
V6.4.1 (opens in a new tab)
V3.5.2 (opens in a new tab)
Attack patterns
Read Sensitive Constants Within an Executable (opens in a new tab)
Try Common or Default Usernames and Passwords (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 1 Dec 2025, 17:45 UTC

WeaknessesCWE-798

Technical details

References

Community reviews

Related threats