The GRID Organiser App up to version 1.0.5 on Android contains a vulnerability where a hard-coded cryptographic key is used within an unknown function related to the file res/raw/app.json in the co.gridapp.organiser component. This flaw can be triggered by manipulating the argument SegmentWriteKey. The attack vector requires local access with low privileges and no user interaction. The CVSS 4.0 base score is 4.8, reflecting a medium severity with low attack complexity and limited impact on confidentiality, integrity, and availability.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to manipulate or bypass cryptographic protections. However, the impact is limited by the requirement for local access and the low privileges needed. There is no indication of remote exploitation or elevated privileges. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict local access to the device and avoid installing untrusted applications that could leverage this vulnerability. Monitor vendor communications for updates regarding patches or mitigations.