This vulnerability concerns the presence of a hard-coded cryptographic key in the Noelse Individuals & Pro App (versions 2.1.0 through 2.1.7) on Android. The key is embedded in the app's BuildConfig.java file under the argument SEGMENT_WRITE_KEY. Because the key is hard-coded, it may be extracted or misused by an attacker with local access to the device. The vulnerability does not require user interaction and has low complexity but requires local privileges. There is no vendor response or patch available at this time.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise confidentiality or integrity related to the key's usage. However, exploitation requires local access, limiting the attack surface. No known exploits are reported in the wild. The medium CVSS score (4.8) reflects these factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should avoid running the affected app versions on untrusted devices or environments. Monitoring for vendor updates is recommended. No specific workaround or temporary fix is documented.