A flaw in the Rico só vantagem pra investir Android application allows an attacker with local access to manipulate the SEGMENT_WRITE_KEY argument in SegmentSettingsModule.java, causing the app to use a hard‑coded cryptographic key. This key exposure means a local adversary could potentially decrypt, sign, or otherwise tamper with data that the application assumes is protected by a unique runtime key. The weakness arises from improper key handling and is classified as CWE‑320 (Hard‑coded Cryptographic Key) and CWE‑321 (Reused Hard‑coded Cryptographic Key). The vulnerability does not provide a Windows or internet‑based exploitation route; it can only be triggered from a device already running the affected app.

The issue affects the Rico só vantagem pra investir App for Android versions up to 4.58.32.12421. The sensitive code resides in the br.com.rico.mobile component, specifically within br/com/rico/mobile/di/SegmentSettingsModule.java. Any device that installs a pre‑4.58.32.12421 build is therefore vulnerable if an attacker can alter the SEGMENT_WRITE_KEY argument locally.

The CVSS base score of 4.8 indicates low‑to‑moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently being targeted by widespread exploitation campaigns. Because the flaw requires local manipulation of the app configuration, the threat is largely confined to situations where an attacker already has physical or root access to the device. Nonetheless, once the key is exposed, the confidentiality and integrity of any data protected under that key are compromised. Administrators should treat the risk as moderate until a vendor‑supplied fix is confirmed. Currently, no public exploit exists beyond the disclosed disclosure.