This vulnerability concerns the presence of a hard-coded cryptographic key in the Wahoo Fitness SYSTM App (up to version 7.2.1) on Android, specifically in an unknown function within the file com/WahooFitness/SYSTM/BuildConfig.java. The issue arises from manipulation of the SEGMENT_WRITE_KEY argument, which leads to the use of a fixed cryptographic key. Exploitation requires local access to the device. The vendor has not issued any response or patch, and no remediation level is provided. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise data confidentiality or integrity related to the affected function. However, the impact is limited by the requirement for local access and the absence of known exploits in the wild. The vulnerability does not involve user interaction or network attack vectors, reducing its overall risk profile.

No official patch or remediation guidance is currently available from the vendor, who has not responded to the disclosure. Users should avoid running untrusted code or granting unnecessary local access to the device. Monitor vendor channels for any future updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.