| Package | Affected versions | Patched versions |
|---|---|---|
| xtool anyscan | ≤ 4.40.40 |
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, allowing them to direct the application to download a malicious update package.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free