What’s Vulnerable › Vulnerabilities
CVE-2026-9220: Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-26 · updated 2026-10-25
- Weakness: CWE-321
Description
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
Affected products
- Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker: through 3.1.5
References
Get alerted when CVE-2026-9220 or the next vulnerability affects your stack