This vulnerability in the GRID Organiser App (versions 1.0.0 through 1.0.5) arises from the use of a hard-coded cryptographic key within an unknown function tied to the file res/raw/app.json. An attacker with local access can manipulate the SegmentWriteKey argument to exploit this weakness. The CVSS 4.0 vector indicates the attack requires local access with low complexity and no user interaction, resulting in limited confidentiality impact and no integrity or availability impact. The exploit has been made public, but no vendor patch or fix information is provided.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations, potentially allowing an attacker with local access to bypass protections relying on this key. The impact is limited to confidentiality with no reported effect on integrity or availability. The vulnerability requires local access and low attack complexity, reducing the likelihood of remote exploitation. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to affected devices and consider monitoring for unauthorized local activity. Avoid relying on the affected cryptographic function for sensitive operations if possible.