EUVD-2026-39598
GHSA-f7c5-2gv6-7rwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain victim password hash from leak/backup/capture
-
DeliveryReplay hash to Setracker2 backend auth API
-
ExploitBackend accepts hash as credential
-
ExecutionAuthenticate as victim
-
ImpactGain full account and device-location access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Use of password hash instead of password
|
| Exploitation Conditions | Exploitation requires the attacker to already know or possess the target account's password hash - the description states authentication only requires the hash, and the CVSS 4.0 AT:P flag confirms this prerequisite. The attacker does not need the plaintext password, does not need to crack the hash, and needs no prior privileges (PR:N) or user interaction (UI:N) against the backend. The principal limiting factor is therefore hash acquisition: the attacker must obtain the hash from a secondary source such as a database leak, an Android backup, local app storage on a compromised device, or intercepted client traffic. This is what bounds real-world risk - it is not a no-precondition remote takeover. |
| Impact | Signals are mixed and should be read carefully. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H) scores 9.2 and reflects network reach, no required privileges, and high confidentiality/integrity/availability impact on the affected account - but the AT:P (attack requirements present) metric is doing important work: exploitation is gated on the attacker first obtaining the victim's password hash, which is not trivially available remotely. There is no EPSS score, no CISA KEV listing, and no SSVC decision data in the provided input, so automatable/exploitation status cannot be derived. No public exploit identified at time of analysis. Net assessment: this is a genuine credential-design weakness with high per-account impact, but practical risk hinges entirely on hash exposure, making it more a targeted/secondary-exposure risk than a mass, internet-wide remote-takeover bug. The high CVSS should not be read as 'trivially exploitable from the internet.' |
| Exploit ScenarioDerived | An attacker obtains a victim's stored Setracker2 password hash - for example from a leaked backend database, a device/app backup, or captured client traffic - and replays that hash directly to the backend authentication endpoint. Since the backend accepts the hash as the credential, the attacker logs in as the victim and gains full account access, including the ability to view the tracked device's location. No public exploit code is identified, and the attacker must first acquire the hash (CVSS AT:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Authentication bypass in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets an attacker who possesses a user's stored password hash authenticate directly to the backend and gain full account access. Because the backend treats the password hash itself as the secret credential, the hash is password-equivalent and does not need to be cracked back to plaintext. No public exploit identified at time of analysis; the issue was disclosed through CISA/ICS-CERT (advisory VA-26-176-01) and carries a high CVSS 4.0 score of 9.2.
RemediationAI
No vendor-released patch identified at time of analysis; no fixed version was supplied in the input data, so do not assume an upgrade target - consult the CISA advisory VA-26-176-01 (https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json) and TGELEC for a corrected build before relying on one. Because the flaw is server-side credential handling that users cannot fix in the client, the practical compensating controls are: treat any exposed or leaked password hash as a full credential compromise and force a password reset/credential rotation for affected accounts; restrict or monitor backend authentication for anomalous logins and replayed credentials; and minimize hash exposure by protecting device backups, app storage, and network paths (enforce TLS, avoid sideloaded or modified builds). Where the GPS service is non-essential, consider limiting use of the affected app version until a fixed release is confirmed, accepting the trade-off of lost tracking functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Setracker2 is a consumer mobile companion app (package com.tgelec.setracker) used to manage and locate TGELEC/Setracker-family GPS tracking devices such as kids' and elderly GPS smartwatches. The root cause is CWE-836 (Use of Password Hash Instead of Password for Authentication): the client transmits and the backend accepts a password hash as the sole authenticating factor, rather than treating the hash as a server-side verifier of a freshly supplied plaintext password. As a result the hash becomes a directly replayable, password-equivalent credential - a pass-the-hash condition - so anyone who recovers the hash (from app storage, a database leak, network capture, or backup) can impersonate the account without ever knowing the real password.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable backend auth (AV:N) with no privileges or interaction, but AC:H because the attacker must first obtain the victim's password hash; full account compromise yields C/I/A:H.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
DescriptionCVE.org
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.
Executive ViewAI
A critical authentication bypass in the Setracker2 Android app (versions 3.1.5 and earlier) allows attackers with access to stored password hashes to take complete control of user accounts without needing plaintext passwords. No public exploit identified at time of analysis. This affects organizations relying on Setracker2 for IoT device management and end-users whose stored credentials are at risk; account compromise enables unauthorized device control and data access.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce immediate password changes across all Setracker2 users, implement strict authentication monitoring and alerting for unauthorized account access, restrict network access to the Setracker2 backend if operationally feasible, maintain detailed audit logs of API access and login attempts, and prepare account recovery procedures. Consider application disablement until patch availability is confirmed, or migrate to an alternative solution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB