This vulnerability in Dialogue App (up to version 4.3.2) arises from the use of a hard-coded cryptographic key located in the res/raw/config.json file. An attacker with local access can manipulate the SEGMENT_WRITE_KEY argument to exploit this weakness. The vulnerability does not require user interaction and has a CVSS 4.8 rating, indicating medium severity. The vendor has not provided a fix or advisory, and no known exploits are reported in the wild.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise confidentiality or integrity related to the affected component. However, exploitation is limited to local attackers and does not require user interaction, reducing the overall risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should limit local access to affected devices and monitor for updates from the vendor. Avoid using affected versions where possible until a patch is released.