The SYSTM App includes a hard‑coded cryptographic key in BuildConfig.java, accessed via the SEGMENT_WRITE_KEY argument. Altering this argument causes the application to use the hard‑coded key, potentially allowing data injection and manipulation of user profiles. This weakness permits an attacker to compromise the integrity of the data sent to the service.

Wahoo Fitness SYSTM App on Android, versions up to 7.2.1. The vulnerability resides specifically in the com.WahooFitness.SYSTM component.

The CVSS score of 4.8 indicates moderate severity, and the fact that the exploit is publicly available increases the practical risk. Local access is required to manipulate the argument, which limits remote exploitation unless local privilege is obtained. The EPSS score is not available and the vulnerability is not listed in current KEV catalogues, suggesting it is not a widely exploited or prioritized threat at present, but local attackers targeting devices with this app could still pose a risk.