This vulnerability involves the use of a hard-coded cryptographic key in the UCC CampusConnect App (versions 14.3.0 through 14.3.5) on Android. The hard-coded key is embedded in the app's BuildConfig.java file, which could allow an attacker with local access to the device to potentially compromise cryptographic operations relying on this key. The attack vector is local, with low attack complexity and no user interaction required. The CVSS 4.0 base score is 4.8, indicating medium severity. Exploit code has been published, but there is no indication of known exploits in the wild or an official patch.

The vulnerability allows an attacker with local access to the affected device to exploit the hard-coded cryptographic key, potentially undermining the confidentiality or integrity of cryptographic operations within the app. Since the attack requires local access and privileges, the impact is limited compared to remote vulnerabilities. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to their devices and avoid installing untrusted applications that could leverage this vulnerability. Monitor official UCC communications for updates regarding patches or mitigations.