CVE-2026-9221
Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 25, 2026
- Updated
- Aug 3, 2026
- Reserved
- May 21, 2026
Description
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the session ID exposed, an attacker could impersonate the legitimate user and issue authenticated API requests.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected Products
| Product | Versions |
|---|---|
Setracker2 Parental Control App (Android) package com.tgelec.setrackerShenzhen i365-Tech Co. Ltd. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.