This vulnerability arises from the use of a hard-coded cryptographic key in an unknown function related to the file assets/google-services-desktop.json in the Investory Toy Planet Trouble App (versions 1.5.0 through 1.5.5) on Android. The flaw allows an attacker with local access to manipulate the argument current_key, potentially compromising cryptographic operations relying on this key. The vulnerability has a CVSS 4.8 rating, indicating a medium level of severity, with low attack complexity and requiring local privileges. The exploit code is publicly available, increasing the risk of exploitation. No official patch or remediation level has been disclosed by the vendor as of the publication date.

The vulnerability allows an attacker with local access to exploit the use of a hard-coded cryptographic key, which may undermine the confidentiality or integrity of cryptographic operations within the app. The impact is limited by the requirement for local access and low complexity of attack, but the presence of a public exploit increases the risk of compromise. No direct information on the specific consequences of exploitation (such as data leakage or privilege escalation) is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, restrict local access to affected devices and consider mitigating exposure by limiting app usage on untrusted devices.