CVE-2026-5462

LOW

Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key

Title source: cna

Description

A vulnerability was identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfig.java of the component com.WahooFitness.SYSTM. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key . Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-355053 | Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key

https://vuldb.com/vuln/355053

Signature, Permissions Required signature permissions-required

VDB-355053 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/355053/cti

Third Party Advisory third-party-advisory

Submit #781767 | Wahoo Fitness Wahoo SYSTM(com.WahooFitness.SYSTM) 7.2.1 Segment Write Key Exposure

https://vuldb.com/submit/781767

Exploit exploit

https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-WahooFitne-3262de3f97fb8038808eed63af1a48b8?source=copy_link

Scores

CVSS v3 3.3

EPSS 0.0016

EPSS Percentile 5.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-320 CWE-321

Status published

Products (2)

Wahoo Fitness/SYSTM App 7.2.0

Wahoo Fitness/SYSTM App 7.2.1

Published Apr 03, 2026

Tracked Since Apr 03, 2026