Sogexia Android App Hardcoded Encryption Keys Vulnerability

A vulnerability exists in the Sogexia Android application, specifically in versions compiled with SDK 35 and prior to 36. The issue involves hardcoded encryption keys embedded in the 'encryption_helper.dart' file. This vulnerability was identified through static analysis and reverse engineering of the app's APK, revealing Base64-encoded cryptographic material, including sequences resembling AES keys, directly embedded in the code.

Impact

The hardcoded keys could be extracted and potentially misused, leading to unauthorized access or manipulation of encrypted data.

Remediation

Users of the Sogexia Android app should update to version 36 or later, where this vulnerability has been addressed by removing hardcoded keys and likely implementing a secure key management process.