A flaw in the PropertyGuru AgentNet Singapore App’s BuildConfig.java file allows the hard‑coded SEGMENT_ANDROID_WRITE_KEY and SEGMENT_TOS_WRITE_KEY to be used when the arguments are manipulated. Because the key is embedded in the application, a local attacker can craft requests that leverage this key, enabling injection of data or alteration of user profiles through the Segment analytics service. The vulnerability does not provide remote code execution but can compromise data integrity and privacy for users of the affected app.

Vendors and products affected are the PropertyGuru AgentNet Singapore App, any Android installation of the app with a version of 23.7.10 or earlier. No other vendors or products are listed, and no broader platform or operating system impact is described in the advisory.

The CVSS score of 4.8 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires a local foothold on the device, the attack vector is limited to users who already have the app installed or have gained local device access. However, once the key is exposed, an attacker can send malicious payloads to the Segment endpoint, potentially creating a persistent data injection issue. Given the publicly released exploit, the risk is elevated for devices that remain on vulnerable releases until a vendor patch or a viable workaround is applied.