PT-2026-29995 · Wahoo Fitness · Wahoo Fitness Systm App

Fxizenta · Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-5462

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wahoo Fitness SYSTM App versions through 7.2.1

Description A security issue exists in the Wahoo Fitness SYSTM App on Android, up to version 7.2.1. The issue involves the use of a hard-coded cryptographic key within the file com/WahooFitness/SYSTM/BuildConfig.java of the com.WahooFitness.SYSTM component. Manipulation of the SEGMENT WRITE KEY argument can lead to the exposure of this key. Local access is required for exploitation. The exploit is publicly available.

Recommendations Update to a version beyond 7.2.1 when available. As a temporary workaround, restrict local access to the application.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2026-5462

Affected Products

Wahoo Fitness Systm App

References · 7

• 🔥 https://notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-WahooFitne-3262de3f97fb8038808eed63af1a48b8?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5462 · Security Note
• https://twitter.com/CVEnew/status/2040128718505476576 · Twitter Post
• https://vuldb.com/submit/781767 · Note
• https://vuldb.com/vuln/355053/cti · Note
• https://vuldb.com/vuln/355053 · Note
• https://twitter.com/cyberbivash/status/2040057069600960967 · Twitter Post