CVE-2026-9219 — Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers

CVE-2026-9219

Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers PUBLISHED

Description (CNA)

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

Affected (CNA)

Vendor / product	Versions
Shenzhen i365-Tech Co. Ltd. / Setracker2 Parental Control App (Android) package com.tgelec.setracker	affected 0 through 3.1.5; unaffected 3.4.1

CWE

CWE-340

References

https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.