CVE-2025-63433
|
| |
|
|
Affected software |
ANDROID |
|
|
|
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, allowing them to direct the application to download a malicious update package. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2025-63433 |
