CVE-2026-9219

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-340

Affected software

VendorProductVersions
Shenzhen i365-Tech Co. Ltd.Setracker2 Parental Control App (Android) package com.tgelec.setracker<= 3.1.5

References

Timeline

Published
Jun 26, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-921909.8Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerabilitCVE-2026-921918.8Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackeCVE-2026-921928.8Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackCVE-2026-921936.5Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability. This vulnerability allows remotCVE-2026-921948.8Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remoCVE-2026-921958.8Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attCVE-2026-921967.2Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allCVE-2026-921978.8Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers tCVE-2026-921988.2Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remoteCVE-2026-921997.8Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows locaCVE-2026-92207.5Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with statCVE-2026-922007.8Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attac
CVE-2026-9219: Medium severity, CVSS 6.5 | Vulnix