Brother iPrint&Scan CVE-2025-64696

Exploitation requires a separate attacker-controlled (malicious) Android application to already be installed on the same device as Brother iPrint&Scan 6.13.7 or earlier; the vulnerable app stores application-specific files in an external (shared-storage) cache directory that other apps can read. Limiting factors: the attack is strictly local (no remote vector), depends on the victim installing a second malicious app, is bounded to confidentiality of whatever data the app happens to cache, and only affects the enumerated vulnerable versions - it does not grant integrity or availability impact or code execution.

This is a low-to-moderate priority information-disclosure issue, not an urgent one. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P, VC:L only) describes a locally-scoped confidentiality leak: exploitation requires a second malicious application already present on the same Android device, consistent with CWE-524 (sensitive data left in an insecure external cache directory). EPSS corroborates the low urgency at 0.14% (3rd percentile), and there is no CISA KEV listing and no public exploit identified - so there is no public exploit identified at time of analysis. The signals are internally consistent: a local-access, low-impact, no-integrity/no-availability flaw with low exploitation probability. The main caveat is that the '4.8' is a CVSS 4.0 base score, not 3.1, so tools expecting 3.1 may mis-rank it; the local attack vector means it cannot be exploited remotely despite the network-facing nature of a print app. No conflicting signals, but affected-version data comes only from the advisory description (6.13.7 and earlier) and has not been independently cross-checked against a CPE list.

A user installs the Brother iPrint&Scan Android app (v6.13.7 or earlier) alongside a separate malicious app that requests no special permissions. Because iPrint&Scan writes application-specific files to a world-readable external cache directory, the malicious app reads those cached files and exfiltrates any sensitive data they contain (e.g., scanned documents or metadata). No public exploit is known, and the attack is bounded by the need for the victim to have both apps installed.