CVE-2025-63432

{
  "id": "CVE-2025-63432",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-24T17:16:07.510",
  "lastModified": "2026-11-05T13:10:00.180",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution."
    },
    {
      "lang": "es",
      "value": "La aplicación Xtooltech Xtool AnyScan para Android 4.40.40 y versiones anteriores carece de validación de certificado SSL. La aplicación no valida correctamente el certificado TLS de su servidor de actualizaciones. Un atacante en la misma red puede explotar esta vulnerabilidad realizando un ataque Man-in-the-Middle (MitM) para interceptar, descifrar y modificar el tráfico entre la aplicación y el servidor de actualizaciones. Esto sirve como base para ataques posteriores, incluida la ejecución remota de código."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-24T18:17:07.155527Z",
          "id": "CVE-2025-63432",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-599"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:xtooltech:xtool_anyscan:*:*:*:*:*:android:*:*",
              "versionEndIncluding": "4.40.40",
              "matchCriteriaId": "9206BD15-A1A8-4913-9D0A-9ADE50B81994"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}