by Kastro
Paper/Archive/CVE-2026-9222

CVE-2026-9222

Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker — Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
35
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 35.5.355 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.

Affected

ProductAffectedFixed inSource
Setracker2 Parental Control App (Android) package com.tgelec.setracker≤ 3.1.5–CNA
Setracker2 Parental Control App (Android) package com.tgelec.setracker3.4.1–CNA

Scores by source

icscert (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
icscert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refraw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json