The LaserGest mobile application encrypts assistance portal credentials using a hardcoded AES key and IV. Because the key is fixed within the application bundle, an adversary who obtains the APK or loaded package can extract the key and decrypt stored credentials, exposing usernames and passwords in cleartext. This vulnerability allows an attacker who can access the application package to compromise credential confidentiality, potentially giving unauthorized access to the assistance portal.

LaserGest mobile application from LaserVideo. Specific versions affected are not detailed in the advisory, so any build of the app that includes the hardcoded key is considered vulnerable. Administrators should examine installed versions for the presence of the hardcoded AES key and update to an unaffected release as soon as one is available.

The CVSS score of 6.6 indicates a moderate severity vulnerability. EPSS is not provided, and the issue is not listed in CISA KEV, suggesting that, while exploitable, it is not a known widely used exploit. The likely attack vector requires local access to the application package; attackers can obtain the package through direct device access or by downloading the APK. Once the code is obtained, the hardcoded key can be extracted, allowing credential recovery with minimal effort. The impact on confidentiality is significant, but availability is not affected.