CVE-2026-9222
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. An attacker who knows the hash can authenticate and gain full access.
Risk Assessment
The risk is that an attacker with knowledge of the password hash (e.g., obtained from a leak or interception) can impersonate the user and take full control of their account and data.
Recommendation
Immediately update the app to the latest version that fixes this vulnerability. If no update is available, consider temporarily disabling the app until a patch is released.
Other vulnerabilities in Setracker2 Android Companion App (com.tgelec.setracker) wersje 3.1.5 i wcześniejsze
See all- CVE-2026-9220High
The Setracker2 Android Companion App versions 3.1.5 and prior encrypts communication between the watch and its backend using static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
- CVE-2026-9219Medium
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and prior generate a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment, allowing an attacker who obtains the registration ID to arbitrarily enroll watches belonging to other users.
Original NVD description (English source)
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.