CVE-2025-63432

Katalog CVE

CVSS 4.6 · Medium EPSS 0,17%

Kerentanan Missing Validation of OpenSSL Certificate pada xtooltech xtool anyscan. Skor CVSS 3.1 4.6 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.

Rincian

Terbit di NVD

24 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.6 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-599: Missing Validation of OpenSSL Certificate

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432 advisory pihak ketiga
• https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phone... exploit · advisory pihak ketiga