Google EUVD-2026-39591

Setracker2 Android app (versions 3.1.5 and prior) allows unauthenticated remote attackers to hijack GPS smartwatches and access real-time location data by guessing predictably-derived registration IDs. Organizations deploying these devices for family or personnel tracking face direct privacy exposure, particularly for children and field staff whose locations can be compromised without detection or user consent. The absence of an available vendor patch creates sustained organizational risk requiring immediate inventory and mitigation action.

Within 24 hours: Audit all Setracker2 deployments, document affected versions, and identify high-priority targets (child tracking, field operations). Within 7 days: Notify users of compensating controls (disable location sharing, restrict device visibility, monitor account access); contact vendor for patch release timeline and escalate within your organization's vulnerability management process. Within 30 days: Pilot alternative smartwatch platforms with stronger enrollment controls; initiate migration planning if vendor patch remains unavailable beyond 60 days.

No vendor-released patch identified at time of analysis. Interim mitigations: restrict device enrollment to enterprise-controlled networks, enforce device-level Android permission controls limiting location data access, implement real-time alerting on account login anomalies, disable non-essential location-sharing features in app configuration, educate users to safeguard IMEI and registration information, and consider temporary operational restrictions on new device deployments until patched.