Which versions of Setracker2 are affected by CVE-2026-9220?

Setracker2 GPS-watch devices running Android companion app version 3.1.5 and earlier contain hardcoded encryption credentials, allowing attackers to decrypt location and account data belonging to…

How to fix or mitigate CVE-2026-9220?

Within 24 hours: identify all deployed Setracker2 instances and affected user populations; assess whether location data is classified as sensitive personal information under your data protection policies. Within 7 days: implement backend API access logging and anomaly detection; restrict further distribution of app versions 3.1.5 and earlier; prepare internal privacy impact assessment and breach notification strategy. Within 30 days: contact vendor requesting security patch timeline and technical remediation plan; establish 60-day deadline for vendor patch delivery or organizational migration to alternative GPS-watch solutions.

Setracker2 CVE-2026-9220

Q: What is the CVSS score of CVE-2026-9220?

CVE-2026-9220 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39592 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-26 ics-cert@hq.dhs.gov

GHSA-9ppg-rg73-3244

Information Disclosure Google

8.7

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

AV:N and PR:N/UI:N since keys come from the public APK with no auth, but AC:H because the attacker must first be positioned to intercept traffic; confidentiality-only (C:H, I/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 00:31 vuln.today

CVE Published

Jun 26, 2026 - 00:16 cve.org

HIGH 8.7

DescriptionCVE.org

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.

AnalysisAI

Cleartext recovery of Setracker2 GPS-watch traffic is possible because the com.tgelec.setracker Android companion app (versions 3.1.5 and prior) protects watch-to-backend requests with static, hardcoded AES keys and initialization vectors. Any attacker who can observe the encrypted traffic - or who extracts the keys from the freely distributed APK - can decrypt communications between the wearable tracker and its cloud backend, exposing location and account data of the (frequently child) wearers. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Setracker2 is a consumer companion app for low-cost GPS/GSM tracking watches (commonly marketed as children's smartwatches) built by TGELEC, communicating with a vendor cloud backend. The flaw is classified CWE-321 (Use of Hard-coded Cryptographic Key): the AES symmetric key and IV used to encrypt request payloads are embedded as static constants in the application binary rather than negotiated per-session or per-device. Because symmetric AES provides confidentiality only when the key is secret, baking a single key (and a fixed IV, which also undermines CBC/CTR-mode semantics) into every installed copy means the 'encryption' offers no real confidentiality against anyone who reverse-engineers the APK. The CWE points squarely at the root cause: secrecy of an AES key cannot be maintained in client-distributed software.

RemediationAI

No vendor-released patch version is identified in the available data, so a specific fixed release cannot be cited; consult the CISA advisory VA-26-176-01 (https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json) for any vendor update once published. Because the weakness is inherent to the app's static key design, end users cannot reconfigure their way out of it; practical compensating controls are to avoid storing or transmitting sensitive details through the watch where possible, treat all watch-reported location as potentially exposed, and for risk-averse users discontinue use of the device until the vendor ships a build that derives per-device or per-session keys - the trade-off being loss of tracking functionality. Network operators cannot meaningfully mitigate via TLS pinning here since the broken layer is the app's own payload encryption, not the transport. Verify any claimed fix independently, as the patched version is not confirmed in this dataset.