CVE Explorer

CVE-2025-63432

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:2add99bd84308d492ea876a0c6e907129331a5778120a07787f897fc1a675c7b

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-599","description":"CWE-599 Missing Validation of OpenSSL Certificate","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/adp/0/problemTypes/0/descriptions/0

{"description":"n/a","lang":"en","type":"text"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-599","description":"CWE-599 Missing Validation of OpenSSL Certificate","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/adp/0/problemTypes/0/descriptions/0

{"description":"n/a","lang":"en","type":"text"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/cna/references/1

{"url":"https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:022084795589b1a3f2cfa108f81399c3b858df00026b786d48af4e74c19e4c2c · sha256:4d26a149f3d31dd4… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer