CVE-2026-5457

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5457", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-02T22:21:55.784Z", "datePublished": "2026-04-03T06:30:13.798Z", "dateUpdated": "2026-04-03T14:44:45.908Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-03T06:30:13.798Z"}, "title": "PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-321", "lang": "en", "description": "Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-320", "lang": "en", "description": "Key Management Error"}]}], "affected": [{"vendor": "PropertyGuru", "product": "AgentNet Singapore App", "versions": [{"version": "23.7.0", "status": "affected"}, {"version": "23.7.1", "status": "affected"}, {"version": "23.7.2", "status": "affected"}, {"version": "23.7.3", "status": "affected"}, {"version": "23.7.4", "status": "affected"}, {"version": "23.7.5", "status": "affected"}, {"version": "23.7.6", "status": "affected"}, {"version": "23.7.7", "status": "affected"}, {"version": "23.7.8", "status": "affected"}, {"version": "23.7.9", "status": "affected"}, {"version": "23.7.10", "status": "affected"}], "modules": ["com.allproperty.android.agentnet"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key\r . The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-03T00:27:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355045", "name": "VDB-355045 | PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355045/cti", "name": "VDB-355045 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/781764", "name": "Submit #781764 | PropertyGuru AgentNet Singapore(com.allproperty.android.agentnet) 23.7.10 Segment Write Key Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-allpropert-3262de3f97fb80b5aa5ae52475bf155e?source=copy_link", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T14:44:34.714888Z", "id": "CVE-2026-5457", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T14:44:45.908Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5457", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T14:44:34.714888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T14:44:41.715Z"}}], "cna": {"title": "PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "PropertyGuru", "modules": ["com.allproperty.android.agentnet"], "product": "AgentNet Singapore App", "versions": [{"status": "affected", "version": "23.7.0"}, {"status": "affected", "version": "23.7.1"}, {"status": "affected", "version": "23.7.2"}, {"status": "affected", "version": "23.7.3"}, {"status": "affected", "version": "23.7.4"}, {"status": "affected", "version": "23.7.5"}, {"status": "affected", "version": "23.7.6"}, {"status": "affected", "version": "23.7.7"}, {"status": "affected", "version": "23.7.8"}, {"status": "affected", "version": "23.7.9"}, {"status": "affected", "version": "23.7.10"}]}], "timeline": [{"lang": "en", "time": "2026-04-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-03T00:27:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355045", "name": "VDB-355045 | PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355045/cti", "name": "VDB-355045 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/781764", "name": "Submit #781764 | PropertyGuru AgentNet Singapore(com.allproperty.android.agentnet) 23.7.10 Segment Write Key Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-allpropert-3262de3f97fb80b5aa5ae52475bf155e?source=copy_link", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key\r . The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-320", "description": "Key Management Error"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-03T06:30:13.798Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5457", "state": "PUBLISHED", "dateUpdated": "2026-04-03T14:44:45.908Z", "dateReserved": "2026-04-02T22:21:55.784Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-03T06:30:13.798Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["com.allproperty.android.agentnet"], "product": "AgentNet Singapore App", "vendor": "PropertyGuru", "versions": [{"status": "affected", "version": "23.7.0"}, {"status": "affected", "version": "23.7.1"}, {"status": "affected", "version": "23.7.2"}, {"status": "affected", "version": "23.7.3"}, {"status": "affected", "version": "23.7.4"}, {"status": "affected", "version": "23.7.5"}, {"status": "affected", "version": "23.7.6"}, {"status": "affected", "version": "23.7.7"}, {"status": "affected", "version": "23.7.8"}, {"status": "affected", "version": "23.7.9"}, {"status": "affected", "version": "23.7.10"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key\r . The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en la aplicaci\u00f3n PropertyGuru AgentNet Singapore hasta la versi\u00f3n 23.7.10 en Android. Esto afecta una funci\u00f3n desconocida del archivo com/allproperty/android/agentnet/BuildConfig.java del componente com.allproperty.android.agentnet. La manipulaci\u00f3n del argumento SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY resulta en el uso de una clave criptogr\u00e1fica codificada de forma r\u00edgida. El ataque debe ser iniciado desde una posici\u00f3n local. El exploit ha sido liberado al p\u00fablico y puede ser utilizado para ataques. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5457", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5457", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T14:44:34.714888Z", "version": "2.0.3"}}]}, "published": "2026-04-03T07:16:20.793", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/781764"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355045"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355045/cti"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-allpropert-3262de3f97fb80b5aa5ae52475bf155e?source=copy_link"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-320"}, {"lang": "en", "value": "CWE-321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.7.0,23.7.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "AgentNet Singapore App", "source": "cna", "vendor": "PropertyGuru"}, "product": "agentnet_singapore_app", "vendor": "propertyguru"}], "analysis": {"en": {"generated_at": "2026-04-03T10:22:14.851918+00:00", "value": {"mitigation_remediation": ["Check for and install the latest version of PropertyGuru AgentNet Singapore App as soon as a vendor patch is available", "If no update is available, disable or block outbound traffic from the app to Segment analytics endpoints whenever possible to prevent data injection", "Continuously monitor vendor advisories and security bulletins for a formal fix or additional guidance"], "summary": {"action": "Update App", "impact": "Local data manipulation via exposed segment write key"}, "threat_synthesis": {"affected_systems": "Vendors and products affected are the PropertyGuru AgentNet Singapore App, any Android installation of the app with a version of 23.7.10 or earlier. No other vendors or products are listed, and no broader platform or operating system impact is described in the advisory.", "description_and_impact": "A flaw in the PropertyGuru AgentNet Singapore App\u2019s BuildConfig.java file allows the hard\u2011coded SEGMENT_ANDROID_WRITE_KEY and SEGMENT_TOS_WRITE_KEY to be used when the arguments are manipulated. Because the key is embedded in the application, a local attacker can craft requests that leverage this key, enabling injection of data or alteration of user profiles through the Segment analytics service. The vulnerability does not provide remote code execution but can compromise data integrity and privacy for users of the affected app.", "risk_and_exploitability": "The CVSS score of 4.8 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires a local foothold on the device, the attack vector is limited to users who already have the app installed or have gained local device access. However, once the key is exposed, an attacker can send malicious payloads to the Segment endpoint, potentially creating a persistent data injection issue. Given the publicly released exploit, the risk is elevated for devices that remain on vulnerable releases until a vendor patch or a viable workaround is applied."}}}}, "created": "2026-04-03T21:14:48.562734+00:00", "updated": "2026-04-03T21:17:05.478394+00:00", "vendors": ["propertyguru", "propertyguru$PRODUCT$agentnet_singapore_app"]}