CVE-2025-63435
Medium · 4.3CVSS
4.3
EPSS
0.4%
Published
Nov 24, 2025
CISA due date
—
The record
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|