This vulnerability concerns the presence of a hard-coded cryptographic key in the Noelse Individuals & Pro App (up to version 2.1.7) on Android. The issue is located in the component com.afone.noelse, specifically in the file com/reactnative/antelop/BuildConfig.java, where the SEGMENT_WRITE_KEY argument is manipulated to use a fixed cryptographic key. The attack vector requires local access, and the vulnerability has been publicly disclosed with exploit code available. The vendor has not provided any response or patch, and no cloud service remediation applies as this is a local app vulnerability.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise data confidentiality or integrity related to the affected component. However, the impact is limited by the requirement for local access and the absence of known active exploitation in the wild. The CVSS score of 4.8 reflects a medium severity level.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should avoid running the affected versions on untrusted devices or environments where local access by attackers is possible. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.