CVE-2025-64696

Executive Summary

CVE-2025-64696 identifies a security vulnerability in the Brother iPrint&Scan Android application, versions 6.13.7 and earlier. The application improperly uses an external cache directory, which can be accessed by other malicious applications installed on the same device. This flaw allows a local attacker to read application-specific files, potentially exposing sensitive data such as print job metadata, device configurations, or cached documents. The vulnerability has a low CVSS score of 3.3 due to the requirement of local access and user interaction, but it poses a significant risk in shared device environments or when users install untrusted applications.

Supply Chain & Package Security

This vulnerability is specific to the Android ecosystem and the Brother iPrint&Scan application. It is not related to NPM, PyPI, Go, or Ruby packages. The risk is primarily to end-users who have installed the vulnerable application from the Google Play Store or other Android app distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector (AV): Local (L) – The attacker must have access to the same device.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need elevated privileges.
• User Interaction (UI): Required (R) – The victim must have the vulnerable app installed and may need to perform an action.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited exposure of application-specific files.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. Exploitation requires a malicious app on the same device and user interaction. However, in enterprise environments with shared devices or BYOD policies, the risk increases.

Deep Dive & Mechanics

The vulnerability stems from the Android application's use of an external cache directory (e.g., /sdcard/Android/data/com.brother.ptouch.sdk/cache/) without proper permission enforcement. In Android, external storage directories are world-readable by default, meaning any application with the READ_EXTERNAL_STORAGE permission can access files stored there. The Brother iPrint&Scan app stores sensitive data—such as print job logs, device connection details, and cached documents—in this directory, making it accessible to other malicious apps.

Root Cause: The application fails to use internal storage (e.g., getCacheDir()) or properly secure the external cache directory with file permissions or encryption. This violates the principle of least privilege and exposes data to local attackers.

Exploitation Scenario:

1. A user installs the vulnerable Brother iPrint&Scan app.
2. A malicious app (e.g., a trojan or adware) with READ_EXTERNAL_STORAGE permission is installed on the same device.
3. The malicious app scans the external cache directory for files created by Brother iPrint&Scan.
4. The attacker exfiltrates sensitive data, such as print job details or cached documents.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.13.7):

// Vulnerable: Uses external cache directory
File cacheDir = getExternalCacheDir();
File dataFile = new File(cacheDir, "print_job_cache.dat");
// Data is written without encryption
FileOutputStream fos = new FileOutputStream(dataFile);
fos.write(sensitiveData.getBytes());
fos.close();

Patched Code (Hypothetical):

// Patched: Uses internal cache directory
File cacheDir = getCacheDir();
File dataFile = new File(cacheDir, "print_job_cache.dat");
// Data is encrypted before writing
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
// ... encryption logic ...
FileOutputStream fos = new FileOutputStream(dataFile);
fos.write(encryptedData);
fos.close();

The patched version moves data to internal storage (getCacheDir()) which is private to the app, and optionally encrypts sensitive data.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Android device with Brother iPrint&Scan <= 6.13.7 installed.
• Malicious app with READ_EXTERNAL_STORAGE permission.

Exploitation Steps:

1. Create a malicious Android app that requests READ_EXTERNAL_STORAGE permission.
2. On the victim device, install the malicious app.
3. The malicious app scans the external cache directory:

   // Malicious app code
   File externalCache = new File(Environment.getExternalStorageDirectory(), "Android/data/com.brother.ptouch.sdk/cache/");
   File[] files = externalCache.listFiles();
   for (File file : files) {
       // Read and exfiltrate data
       BufferedReader reader = new BufferedReader(new FileReader(file));
       String line;
       while ((line = reader.readLine()) != null) {
           // Send to attacker server
       }
   }
   

4. Exfiltrate data to a remote server.

Blue Team (Defender)

Detection:

• Monitor for apps requesting READ_EXTERNAL_STORAGE permission.
• Use Android Enterprise or MDM solutions to restrict app installations.
• Deploy endpoint detection and response (EDR) agents on Android devices.

Mitigation:

• Update Brother iPrint&Scan to a patched version (when available).
• Use Android's Scoped Storage (Android 10+) to limit app access to external storage.
• Educate users to avoid installing untrusted apps.

Indicators of Compromise (IOCs)

• File Paths:
  • /sdcard/Android/data/com.brother.ptouch.sdk/cache/
  • /storage/emulated/0/Android/data/com.brother.ptouch.sdk/cache/
• File Names:
  • print_job_cache.dat
  • device_config.json
  • *.tmp (temporary cache files)
• Network Traffic:
  • Outbound connections from a malicious app to unknown IPs or domains.
• Permissions:
  • Apps with READ_EXTERNAL_STORAGE and INTERNET permissions.

Detection Engineering

YARA Rule

rule CVE_2025_64696_Brother_iPrintScan_Cache {
    meta:
        description = "Detects Brother iPrint&Scan external cache directory usage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64696"
    strings:
        $cache_path = "/Android/data/com.brother.ptouch.sdk/cache/"
        $app_name = "com.brother.ptouch.sdk"
    condition:
        $cache_path or $app_name
}

Sigma Rule

title: Brother iPrint&Scan External Cache Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects access to Brother iPrint&Scan external cache directory by other apps
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: file_access
detection:
    selection:
        FilePath|contains: "/Android/data/com.brother.ptouch.sdk/cache/"
    condition: selection
falsepositives:
    - Legitimate Brother iPrint&Scan app accessing its own cache
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-64696 Brother iPrint&Scan Data Exfiltration";
    flow:to_server,established;
    content:"/Android/data/com.brother.ptouch.sdk/cache/";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the App: Check the Google Play Store for an updated version of Brother iPrint&Scan. If a patch is available, apply it immediately.
2. Restrict External Storage Access: On Android 10+, enable Scoped Storage to limit app access to external directories.
3. Use MDM Policies: In enterprise environments, use Mobile Device Management (MDM) to block installation of apps with READ_EXTERNAL_STORAGE permission.

Long-Term Fixes:

• Developer Side: Brother should update the app to use internal storage (getCacheDir()) and encrypt sensitive data.
• User Education: Train users to avoid installing apps from untrusted sources and to review app permissions.

Workarounds:

• Uninstall the Brother iPrint&Scan app until a patch is available.
• Use a third-party security app to monitor file access on the device.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert