Cyber Resilience

CVE-2025-63434

HighPublic PoC

Published: 24 November 2025

Published
24 November 2025
Modified
28 November 2025
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 15.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-63434 is a high-severity Download of Code Without Integrity Check (CWE-494) vulnerability in Xtooltech Xtool Anyscan. Its CVSS base score is 8.8 (High).

Operationally, ranked at the 15.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control…

more

the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xtooltech
xtool anyscan
≤ 4.40.40

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-494

Policies can require integrity verification of software prior to installation, reducing risks from unverified downloads.

addresses: CWE-494

Blocks installation of components lacking a valid signature, mitigating download or installation of code without integrity checks.

addresses: CWE-494

Acquisition and maintenance portions of the strategy drive requirements for integrity verification of downloaded or supplied code.

addresses: CWE-494

Mandating integrity control and approved-only changes during development prevents incorporation of code or components lacking integrity validation.

addresses: CWE-494

Supply chain protection requires integrity verification of acquired components, directly reducing insertion or tampering of malicious code during delivery.

addresses: CWE-494

Reduces exposure to code obtained without integrity verification by requiring assurance processes that confirm authenticity and absence of tampering.

addresses: CWE-494

Tamper resistance and detection commonly include integrity verification of code and firmware obtained from external sources.

addresses: CWE-494

Component authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks.

References