Which versions of Google are affected by EUVD-2026-39591?

Setracker2 Android app (versions 3.1.5 and prior) allows unauthenticated remote attackers to hijack GPS smartwatches and access real-time location data by guessing predictably-derived registration…

How to fix or mitigate EUVD-2026-39591?

Within 24 hours: Audit all Setracker2 deployments, document affected versions, and identify high-priority targets (child tracking, field operations). Within 7 days: Notify users of compensating controls (disable location sharing, restrict device visibility, monitor account access); contact vendor for patch release timeline and escalate within your organization's vulnerability management process. Within 30 days: Pilot alternative smartwatch platforms with stronger enrollment controls; initiate migration planning if vendor patch remains unavailable beyond 60 days.

Google EUVD-2026-39591

Q: What is the CVSS score of EUVD-2026-39591?

EUVD-2026-39591 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-9219 HIGH

Generation of Predictable Numbers or Identifiers (CWE-340)

2026-06-26 ics-cert@hq.dhs.gov

GHSA-jpv7-7g7j-hgwr

Information Disclosure Google

8.3

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 00:31 vuln.today

CVE Published

Jun 26, 2026 - 00:16 cve.org

HIGH 8.3

DescriptionCVE.org

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

AnalysisAI

Unauthorized device enrollment in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets remote attackers hijack other users' GPS smartwatches by guessing their registration ID. The registration ID is predictably derived from the device IMEI, and the enrollment workflow performs no secondary authentication before binding a watch to an account, so an attacker who learns or calculates the ID can take over the target's tracker. No public exploit has been identified at time of analysis, and the issue carries a CVSS 4.0 base score of 8.3 with high confidentiality impact, reflecting exposure of a child's or wearer's location data.