What’s Vulnerable › Vulnerabilities
CVE-2026-9221: Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-26 · updated 2026-10-25
- Weakness: CWE-327
Description
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the session ID exposed, an attacker could impersonate the legitimate user and issue authenticated API requests.
Affected products
- Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker: through 3.1.5
References
Get alerted when CVE-2026-9221 or the next vulnerability affects your stack