EUVD-2026-39591
GHSA-jpv7-7g7j-hgwr
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Unauthorized device enrollment in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets remote attackers hijack other users' GPS smartwatches by guessing their registration ID. The registration ID is predictably derived from the device IMEI, and the enrollment workflow performs no secondary authentication before binding a watch to an account, so an attacker who learns or calculates the ID can take over the target's tracker. No public exploit has been identified at time of analysis, and the issue carries a CVSS 4.0 base score of 8.3 with high confidentiality impact, reflecting exposure of a child's or wearer's location data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (hq) · only source for this CVE.
CVSS VectorVendor: hq
DescriptionCVE.org
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.
Executive ViewAI
Setracker2 Android app (versions 3.1.5 and prior) allows unauthenticated remote attackers to hijack GPS smartwatches and access real-time location data by guessing predictably-derived registration IDs. Organizations deploying these devices for family or personnel tracking face direct privacy exposure, particularly for children and field staff whose locations can be compromised without detection or user consent. The absence of an available vendor patch creates sustained organizational risk requiring immediate inventory and mitigation action.
Within 24 hours: Audit all Setracker2 deployments, document affected versions, and identify high-priority targets (child tracking, field operations). Within 7 days: Notify users of compensating controls (disable location sharing, restrict device visibility, monitor account access); contact vendor for patch release timeline and escalate within your organization's vulnerability management process. Within 30 days: Pilot alternative smartwatch platforms with stronger enrollment controls; initiate migration planning if vendor patch remains unavailable beyond 60 days.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict device enrollment to enterprise-controlled networks, enforce device-level Android permission controls limiting location data access, implement real-time alerting on account login anomalies, disable non-essential location-sharing features in app configuration, educate users to safeguard IMEI and registration information, and consider temporary operational restrictions on new device deployments until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB