Weak Encryption in Setracker2 Android Companion App by Tgelec
CVE-2026-9220

8.7HIGH

Key Information:

Vendor

Shenzhen I365-tech Co. Ltd.

Status
Setracker2 Parental Control App (android) Package Com.tgelec.setracker
Vendor
CVE Published:
25 June 2026

What is CVE-2026-9220?

The Setracker2 Android Companion App, designed for Tgelec smartwatches, utilizes static hardcoded AES keys and initialization vectors for encrypting requests to its backend. This flawed cryptographic implementation can be exploited by attackers to decrypt communications between the smartwatches and the app, potentially exposing sensitive user information and compromising the security of connected devices.

Affected Version(s)

Setracker2 Parental Control App (Android) package com.tgelec.setracker 0 <= 3.1.5

References

https://raw.githubusercontent.com/cisagov/CSAF/refs/heads...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Huancheng Hu of Hasso Plattner Institute reported these vulnerabilities to CISA, with support from Prof. Christian Doerr.
.