This vulnerability in Dialogue App (versions 4.3.0 to 4.3.2) arises from the use of a hard-coded cryptographic key located in the res/raw/config.json file of the ca.diagram.dialogue component. An attacker with local access can manipulate the SEGMENT_WRITE_KEY argument to exploit this weakness. The CVSS 4.0 base score is 4.8, reflecting a medium severity with local attack vector and low complexity. The vendor has not provided any patch or official remediation, and the vulnerability is publicly disclosed but not actively exploited in the wild.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise confidentiality or integrity related to the affected component. However, exploitation is limited to local attackers with low privileges and does not require user interaction. There is no indication of remote exploitation or widespread active attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider limiting local access to affected devices and monitor for updates from the vendor. Avoid using affected versions if possible until a fix is released.