Authentication Bypass Vulnerability in Setracker2 Android Companion App
CVE-2026-9222

9.2CRITICAL

Key Information:

Vendor

Shenzhen I365-tech Co. Ltd.

Status
Setracker2 Parental Control App (android) Package Com.tgelec.setracker
Vendor
CVE Published:
25 June 2026

What is CVE-2026-9222?

The Setracker2 Android Companion App has a vulnerability in its authentication mechanism that only requires a password hash for authentication with backend services. As a result, if an attacker obtains this hash, they could successfully authenticate as any user, thereby gaining unauthorized full access to user accounts and sensitive information.

Affected Version(s)

Setracker2 Parental Control App (Android) package com.tgelec.setracker 0 <= 3.1.5

References

https://raw.githubusercontent.com/cisagov/CSAF/refs/heads...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Huancheng Hu of Hasso Plattner Institute reported these vulnerabilities to CISA, with support from Prof. Christian Doerr.
.