CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Huancheng Hu (Hasso Plattner Institute)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2026-9222 | CWE-836 Use of Password Hash Instead of Password for Authentication | 8.1 High |
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: The vendor has released an updated version of the software. Affected users should update the software to version 3.4.1 or later. ↗ Mitigation: For more information, affected users are encouraged to contact the vendor or their local supplier. ↗ Affected, fixed & timelineAffected:
Fixed in:
Coordination timeline:
|
| CVE-2026-9220 | CWE-321 Use of Hard-coded Cryptographic Key | 7.5 High |
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic. CISA SSVC — Exploitation: None · Automatable: Yes Vendor fix: The vendor has released an updated version of the software. Affected users should update the software to version 3.4.1 or later. ↗ Mitigation: For more information, affected users are encouraged to contact the vendor or their local supplier. ↗ Affected, fixed & timelineAffected:
Fixed in:
Coordination timeline:
|
| CVE-2026-9221 | CWE-327 Use of a Broken or Risky Cryptographic Algorithm | 7.5 High |
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the session ID exposed, an attacker could impersonate the legitimate user and issue authenticated API requests. CISA SSVC — Exploitation: None · Automatable: Yes Vendor fix: The vendor has released an updated version of the software. Affected users should update the software to version 3.4.1 or later. ↗ Mitigation: For more information, affected users are encouraged to contact the vendor or their local supplier. ↗ Affected, fixed & timelineAffected:
Fixed in:
Coordination timeline:
|
| CVE-2026-9219 | CWE-340 Generation of Predictable Numbers or Identifiers | 6.5 Medium |
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: The vendor has released an updated version of the software. Affected users should update the software to version 3.4.1 or later. ↗ Mitigation: For more information, affected users are encouraged to contact the vendor or their local supplier. ↗ Affected, fixed & timelineAffected:
Fixed in:
Coordination timeline:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2026-9222 | 9.2 Critical | Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend servic… |
| CVE-2026-9220 | 8.7 High | Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardco… |
| CVE-2026-9221 | 8.7 High | Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating co… |
| CVE-2026-9219 | 8.3 High | Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment s… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.