CVE-2026-5458

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5458", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-02T22:23:25.416Z", "datePublished": "2026-04-03T07:00:16.331Z", "dateUpdated": "2026-04-03T11:17:55.821Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-03T07:00:16.331Z"}, "title": "Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-321", "lang": "en", "description": "Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-320", "lang": "en", "description": "Key Management Error"}]}], "affected": [{"vendor": "Noelse", "product": "Individuals & Pro App", "versions": [{"version": "2.1.0", "status": "affected"}, {"version": "2.1.1", "status": "affected"}, {"version": "2.1.2", "status": "affected"}, {"version": "2.1.3", "status": "affected"}, {"version": "2.1.4", "status": "affected"}, {"version": "2.1.5", "status": "affected"}, {"version": "2.1.6", "status": "affected"}, {"version": "2.1.7", "status": "affected"}], "modules": ["com.afone.noelse"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/BuildConfig.java of the component com.afone.noelse. This manipulation of the argument SEGMENT_WRITE_KEY causes use of hard-coded cryptographic key\r . The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-03T00:28:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355046", "name": "VDB-355046 | Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355046/cti", "name": "VDB-355046 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/781766", "name": "Submit #781766 | Noelse Noelse - Individuals & Pro(com.afone.noelse) 2.1.7 Segment Write Key Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-afone-noel-3262de3f97fb80549986ddd8a160ed32?source=copy_link", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T11:16:58.833724Z", "id": "CVE-2026-5458", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T11:17:55.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5458", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T11:16:58.833724Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T11:17:29.777Z"}}], "cna": {"title": "Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Noelse", "modules": ["com.afone.noelse"], "product": "Individuals & Pro App", "versions": [{"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.1.1"}, {"status": "affected", "version": "2.1.2"}, {"status": "affected", "version": "2.1.3"}, {"status": "affected", "version": "2.1.4"}, {"status": "affected", "version": "2.1.5"}, {"status": "affected", "version": "2.1.6"}, {"status": "affected", "version": "2.1.7"}]}], "timeline": [{"lang": "en", "time": "2026-04-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-03T00:28:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355046", "name": "VDB-355046 | Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355046/cti", "name": "VDB-355046 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/781766", "name": "Submit #781766 | Noelse Noelse - Individuals & Pro(com.afone.noelse) 2.1.7 Segment Write Key Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-afone-noel-3262de3f97fb80549986ddd8a160ed32?source=copy_link", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/BuildConfig.java of the component com.afone.noelse. This manipulation of the argument SEGMENT_WRITE_KEY causes use of hard-coded cryptographic key\r . The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-320", "description": "Key Management Error"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-03T07:00:16.331Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5458", "state": "PUBLISHED", "dateUpdated": "2026-04-03T11:17:55.821Z", "dateReserved": "2026-04-02T22:23:25.416Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-03T07:00:16.331Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["com.afone.noelse"], "product": "Individuals & Pro App", "vendor": "Noelse", "versions": [{"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.1.1"}, {"status": "affected", "version": "2.1.2"}, {"status": "affected", "version": "2.1.3"}, {"status": "affected", "version": "2.1.4"}, {"status": "affected", "version": "2.1.5"}, {"status": "affected", "version": "2.1.6"}, {"status": "affected", "version": "2.1.7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/BuildConfig.java of the component com.afone.noelse. This manipulation of the argument SEGMENT_WRITE_KEY causes use of hard-coded cryptographic key\r . The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha identificado una debilidad en la aplicaci\u00f3n Noelse Individuals & Pro hasta la versi\u00f3n 2.1.7 en Android. Esto afecta una funci\u00f3n desconocida del archivo com/reactnative/antelop/BuildConfig.java del componente com.afone.noelse. Esta manipulaci\u00f3n del argumento SEGMENT_WRITE_KEY causa el uso de una clave criptogr\u00e1fica codificada de forma r\u00edgida. El ataque necesita ser lanzado localmente. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5458", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5458", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T11:16:58.833724Z", "version": "2.0.3"}}]}, "published": "2026-04-03T07:16:21.037", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/781766"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355046"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355046/cti"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-afone-noel-3262de3f97fb80549986ddd8a160ed32?source=copy_link"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-320"}, {"lang": "en", "value": "CWE-321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Individuals & Pro App", "source": "cna", "vendor": "Noelse"}, "product": "individuals_&_pro_app", "vendor": "noelse"}], "analysis": {"en": {"generated_at": "2026-04-03T10:22:01.067076+00:00", "value": {"mitigation_remediation": ["Verify the installed Noelse Individuals & Pro App version and ensure it is not 2.1.7 or lower.", "Search for and apply any vendor\u2011supplied patch or newer release that eliminates the hard\u2011coded key.", "If no patch is available, consider uninstalling the application or restricting its device permissions until a fix is issued.", "Monitor device activity for unexpected data writes or profile changes that may indicate exploitation.", "Reach out to Noelse to request a security fix timeline and follow up if no response is received."], "summary": {"action": "Apply Patch", "impact": "Potential data confidentiality and integrity compromise due to hard\u2011coded cryptographic key use"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Android users of Noelse Individuals & Pro App up to version 2.1.7. It involves the com.reactnative.antelope.BuildConfig.java component within com.afone.noelse and is specific to the vendor Noelse.", "description_and_impact": "A weakness in the Noelse Individuals & Pro App allows manipulation of the SEGMENT_WRITE_KEY argument in the BuildConfig.java file, causing the application to use a hard\u2011coded cryptographic key. This flaw enables local attackers to inject data or alter user profiles, compromising both the confidentiality and integrity of sensitive information. The issue corresponds to key management and key generation weaknesses (CWE\u2011320, CWE\u2011321).", "risk_and_exploitability": "With a CVSS score of 4.8 the risk is moderate. Although EPSS data is unavailable and the flaw is not listed in CISA\u2019s KEV catalog, a publicly available exploit exists and the attack model requires local execution on the device. Because the vendor has not yet responded to the disclosure, the likelihood of a future patch remains uncertain, increasing the potential for unmitigated exploitation."}}}}, "created": "2026-04-03T21:14:47.590022+00:00", "updated": "2026-04-03T21:17:04.526573+00:00", "vendors": ["noelse", "noelse$PRODUCT$individuals_&_pro_app"]}