Cyber Resilience

CVE-2025-63432

Xtooltech Xtool Anyscan ≤ 4.40.40

Public PoC
Published
24 November 2025
Modified
28 November 2025
CVSS Score v3.1 4.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
EPSS Score 0.0016 6th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2025-63432 is a medium-severity Missing Validation of OpenSSL Certificate (CWE-599) vulnerability in Xtooltech Xtool Anyscan. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle…

more

(MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.

CWE(s)
CWE-599

Related Threats

MITRE ATT&CK Enterprise Techniques

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1557.002 ARP Cache Poisoning Credential Access
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.
attack.mitre.org →
T1557.003 DHCP Spoofing Credential Access
Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.
attack.mitre.org →
T1557.004 Evil Twin Credential Access
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-63435Same product: Xtooltech Xtool Anyscan
CVE-2025-63433Same product: Xtooltech Xtool Anyscan
CVE-2025-63434Same product: Xtooltech Xtool Anyscan
CVE-2024-41265Shared CWE-599
CVE-2026-25060Shared CWE-599
CVE-2025-56230Shared CWE-599
CVE-2025-56232Shared CWE-599
CVE-2026-62657Shared CWE-599
CVE-2024-41253Shared CWE-599
CVE-2025-12553Shared CWE-599

Affected Assets

xtooltech
xtool anyscan
≤ 4.40.40

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V12.3.5
  • V17.2.8

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management partial match

Authenticator management requires verification of certificate identity and revocation status before use, directly stopping acceptance of unvalidated OpenSSL certificates.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles require correct implementation of cryptographic authentication mechanisms including certificate validation.

SC-8 Transmission Confidentiality and Integrity partial match

Requiring cryptographic integrity protection for transmitted data forces proper certificate validation to establish trusted channels.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-02 full match
prevents

Proper data-in-transit protection via TLS requires certificate validation with SSL_get_verify_result().

PR.PS-06 mostly match
prevents

Secure development practices include implementing correct OpenSSL certificate validation during coding.

PR.AA-03 partial match
prevents

Service and hardware authentication depends on valid certificates, but the control is broader than TLS validation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing could detect missing certificate validation but does not prevent the weakness at development time.

A.8.24 Use of cryptography partial match
prevents

Mandates proper use of cryptography including certificate validation, directly addressing the missing SSL_get_verify_result() check.

A.8.26 Application security requirements partial match
prevents

Application security requirements may specify certificate validation but do not mandate the specific OpenSSL API usage.

A.8.28 Secure coding partial match
prevents

Requires secure coding practices that would include proper certificate validation in OpenSSL usage.

References