This vulnerability arises from the use of a hard-coded cryptographic key in the Rico só vantagem pra investir App on Android, affecting version 4.58.32.12421. The issue is located in the processing of the SEGMENT_WRITE_KEY argument within the SegmentSettingsModule.java component. The presence of a hard-coded key can weaken cryptographic protections, potentially allowing local attackers with access to the device to compromise confidentiality or integrity related to the cryptographic operations that rely on this key. Exploitation requires local access and does not involve user interaction. The vendor has not issued any response or patch following early notification.

The impact is limited to local attackers who can access the device and exploit the hard-coded cryptographic key. This may lead to compromise of cryptographic protections relying on this key, potentially exposing sensitive data or allowing unauthorized actions within the app. The CVSS 4.8 (medium severity) reflects the limited attack vector (local) and the absence of known exploits in the wild. There is no indication of remote exploitation or privilege escalation beyond local access.

Patch status is not yet confirmed — no official fix or patch has been provided by the vendor. Users and administrators should monitor the vendor's communications for any forthcoming updates or patches. Until a fix is available, limiting local access to devices running the affected app version is recommended to reduce risk. No additional vendor-recommended mitigations are currently available.