This vulnerability arises from the presence of a hard-coded cryptographic key within the Wahoo Fitness SYSTM App's BuildConfig.java file, affecting versions up to 7.2.1 on Android. The hard-coded key (SEGMENT_WRITE_KEY) can be manipulated due to its static inclusion in the app, potentially weakening cryptographic protections. Exploitation requires local access with low privileges and does not require user interaction. The CVSS 4.0 base score is 4.8, reflecting a medium severity with limited attack vector and complexity. No vendor response or patch is currently available, and the app is not a cloud service, so remediation depends on vendor action.

The use of a hard-coded cryptographic key can undermine the security of cryptographic operations within the app, potentially allowing an attacker with local access to bypass certain protections or manipulate data protected by this key. However, the impact is limited by the requirement for local access and low privileges, and there is no indication of remote exploitation or privilege escalation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should avoid running untrusted code or granting local access to untrusted parties on affected devices. Monitor for vendor updates or new releases addressing this issue.