EUVD-2026-39597
GHSA-cfh3-g8cw-7pfq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N), but requires capturing signed traffic and reversing an MD5 digest (AC:H); session-ID disclosure gives C:H and replayed authenticated calls a limited integrity impact (I:L).
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the session ID exposed, an attacker could impersonate the legitimate user and issue authenticated API requests.
AnalysisAI
Session hijacking in the Setracker2 Android companion app (com.tgelec.setracker) version 3.1.5 and earlier stems from the use of MD5 to generate the request signature that authenticates traffic between the mobile client and the backend REST API. Because MD5 is cryptographically broken, an attacker who can observe a signed request may reverse the signature to recover the embedded session ID and then impersonate the legitimate user, issuing authenticated API calls against the kids'/GPS-tracker backend. Reported by CISA ICS-CERT (DHS) and tracked in a CSAF advisory; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Setracker2 is the Android companion app for low-cost consumer GPS/locator wearables (commonly children's tracking watches) sold under the TGELEC/3G Electronics ecosystem, communicating with a cloud REST API. The flaw is a CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) issue: the client derives a request 'signature' using MD5, a hash that is fast to compute and offers no meaningful preimage/collision resistance for security-sensitive use. When the session ID is incorporated into an MD5-based signature scheme, the message-authentication property the signature is meant to provide collapses, allowing an attacker who captures signed traffic to brute-force or otherwise reverse the digest and recover the session identifier that should remain secret. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) frames this as a network-reachable confidentiality compromise of the session credential.
RemediationAI
No vendor-released patch version is identified at time of analysis; the source data lists no fixed app build, so monitor the CISA CSAF advisory va-26-176-01 (https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json) and the Google Play listing for com.tgelec.setracker for an update beyond 3.1.5 and apply it once published. Because the root cause is server-acknowledged client signing logic, the durable fix is server-side: replace the MD5 request-signing scheme with an HMAC-based construction (e.g., HMAC-SHA-256) using a per-session secret and bind session IDs to TLS-protected channels so digests cannot be reversed to leak the identifier. As compensating controls pending a fix, enforce strict TLS/certificate pinning to deny attackers access to signed requests in transit (trade-off: pinning can break if backend certs rotate without an app update), shorten session-ID lifetime and rotate session tokens server-side to limit the window of a recovered ID (trade-off: more frequent re-authentication for users), and apply backend anomaly detection on session reuse from new IPs/devices to flag impersonation. Users handling sensitive child-location data should avoid untrusted networks until updated.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today