A flaw in the UCC CampusConnect Android application causes a hard‑coded cryptographic key to be used by the campusconnect.ucc component. This deficiency is classified as a cryptographic key management weakness, which can result in the exposure of sensitive data. An attacker with local access to the device could exploit this defect to read or manipulate protected files, and in some configurations may be able to execute arbitrary code. The vulnerability is listed under CWE‑320 and CWE‑321.

All instances of UCC CampusConnect App installed on Android devices running version 14.3.5 or earlier are affected. The issue originates in the campusconnect/BuildConfig.java source, and the vulnerability exists up to and including build 14.3.5. No additional versions have been documented as impacted.

The CVSS base score is 4.8, indicating a moderate impact. EPSS data is not available, and the vulnerability is not included in the CISA KEV catalog, which suggests a lower probability of widespread exploitation at present. Nevertheless, because the flaw can be triggered on any device that has local administrative or user access, the risk to each compromised device is relatively high. An attacker would need physical or local logical access, but once that is achieved, no further remote entry is required.