Which versions of Setracker2 are affected by CVE-2026-9222?

A critical authentication bypass in the Setracker2 Android app (versions 3.1.5 and earlier) allows attackers with access to stored password hashes to take complete control of user accounts without…

How to fix or mitigate CVE-2026-9222?

Within 24 hours: Inventory all deployed Setracker2 instances (com.tgelec.setracker v3.1.5 and below) and assess whether password hashes may have been exposed through prior breaches or unauthorized access. Within 7 days: Force users to change passwords immediately, implement enhanced monitoring for unauthorized account logins and API activity, and restrict Setracker2 backend access if operationally feasible. Within 30 days: Apply vendor-released patch immediately upon availability; until then, evaluate whether disabling the app or replacing it with an alternative is operationally necessary.

Setracker2 CVE-2026-9222

Q: What is the CVSS score of CVE-2026-9222?

CVE-2026-9222 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39598 CRITICAL

Use of Password Hash Instead of Password for Authentication (CWE-836)

2026-06-26 ics-cert@hq.dhs.gov

GHSA-f7c5-2gv6-7rwj

Information Disclosure Google

9.2

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable backend auth (AV:N) with no privileges or interaction, but AC:H because the attacker must first obtain the victim's password hash; full account compromise yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 00:33 vuln.today

CVE Published

Jun 26, 2026 - 00:16 cve.org

CRITICAL 9.2

DescriptionCVE.org

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.

AnalysisAI

Authentication bypass in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets an attacker who possesses a user's stored password hash authenticate directly to the backend and gain full account access. Because the backend treats the password hash itself as the secret credential, the hash is password-equivalent and does not need to be cracked back to plaintext. No public exploit identified at time of analysis; the issue was disclosed through CISA/ICS-CERT (advisory VA-26-176-01) and carries a high CVSS 4.0 score of 9.2.

Technical ContextAI

Setracker2 is a consumer mobile companion app (package com.tgelec.setracker) used to manage and locate TGELEC/Setracker-family GPS tracking devices such as kids' and elderly GPS smartwatches. The root cause is CWE-836 (Use of Password Hash Instead of Password for Authentication): the client transmits and the backend accepts a password hash as the sole authenticating factor, rather than treating the hash as a server-side verifier of a freshly supplied plaintext password. As a result the hash becomes a directly replayable, password-equivalent credential - a pass-the-hash condition - so anyone who recovers the hash (from app storage, a database leak, network capture, or backup) can impersonate the account without ever knowing the real password.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed version was supplied in the input data, so do not assume an upgrade target - consult the CISA advisory VA-26-176-01 (https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json) and TGELEC for a corrected build before relying on one. Because the flaw is server-side credential handling that users cannot fix in the client, the practical compensating controls are: treat any exposed or leaked password hash as a full credential compromise and force a password reset/credential rotation for affected accounts; restrict or monitor backend authentication for anomalous logins and replayed credentials; and minimize hash exposure by protecting device backups, app storage, and network paths (enforce TLS, avoid sideloaded or modified builds). Where the GPS service is non-essential, consider limiting use of the affected app version until a fixed release is confirmed, accepting the trade-off of lost tracking functionality.