This vulnerability arises from the use of a hard-coded cryptographic key in the Rico só vantagem pra investir App on Android, affecting version 4.58.32.12421. The issue is located in the processing of the SEGMENT_WRITE_KEY argument within the SegmentSettingsModule.java component. Because the key is hard-coded, it could potentially be extracted by an attacker with local access, undermining cryptographic protections that rely on this key. The attack vector is local, requiring the attacker to have some level of access to the device. The vendor has been notified but has not issued any fix or advisory.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise data confidentiality or integrity protected by this key. However, since exploitation requires local access and no remote attack vector is present, the overall impact is limited to scenarios where an attacker can interact directly with the device. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should limit local access to their devices and consider removing or restricting use of the affected app version until a patch or official guidance is available.