CVE-2026-9219 Details
Description
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.
A vulnerability exists in the Setracker2 Android Companion App (com.tgelec.setracker) in versions through 3.1.5. The issue arises from a predictable registration ID that is derived from the device's IMEI. The app's enrollment system does not implement additional authentication before assigning registration IDs. As a result, if an attacker obtains a registration ID, they can arbitrarily enroll smartwatches belonging to other users.
The vendor has not responded to coordination attempts. No known remediations are available. Affected users are encouraged to contact the vendor or their local supplier.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 26, 2026CNA
Assessed Jan 1, 1References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-340 | Generation of Predictable Numbers or Identifiers | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shenzhen i365-Tech Co. Ltd. Setracker2 | <= 3.1.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |