CVE-2026-9219: Setracker2 Auth Bypass Vulnerability

CVE-2026-9219 Overview

CVE-2026-9219 affects the Setracker2 Android companion app (com.tgelec.setracker) in versions 3.1.5 and prior. The vulnerability stems from a predictable registration identifier derived directly from the device IMEI. The enrollment workflow does not require any additional authentication before binding a watch to an account. Attackers who obtain or guess a registration ID can enroll wearable devices belonging to other users. This creates unauthorized access to child and family tracking devices managed through the Setracker2 platform. The weakness is classified as [CWE-340] Generation of Predictable Numbers or Identifiers.

Critical Impact
An attacker with knowledge of a target IMEI can enroll another user's watch remotely, gaining access to sensitive location and tracking data without credentials.

Affected Products

Setracker2 Android Companion App com.tgelec.setracker version 3.1.5
Setracker2 Android Companion App com.tgelec.setracker all prior versions
Wearable tracking devices enrolled through the Setracker2 platform

Discovery Timeline

2026-06-26 - CVE-2026-9219 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-9219

Vulnerability Analysis

The Setracker2 companion app manages enrollment of GPS tracking watches, commonly used for child safety. The application generates a registration ID that is deterministically derived from the device IMEI (International Mobile Equipment Identity). IMEI values follow a structured 15-digit format with limited entropy and are often exposed through packaging, receipts, or device labels. Because the enrollment endpoint accepts the registration ID as the sole binding factor, no proof of physical possession or account ownership is validated. An attacker who obtains or brute-forces a valid IMEI-derived registration ID can associate the target watch with an attacker-controlled account. This grants ongoing access to the device's location telemetry, communication features, and safety perimeter data.

Root Cause

The root cause is twofold. First, the registration ID generation algorithm uses IMEI as the seed input without applying a secret, salt, or cryptographic randomness. Second, the enrollment API accepts this predictable identifier as sufficient proof of ownership. The design violates secure identifier generation principles outlined in [CWE-340].

Attack Vector

Exploitation requires network access to the Setracker2 enrollment infrastructure. An attacker enumerates or obtains a target IMEI, computes the derived registration ID, and submits an enrollment request. No user interaction on the victim device is required. The vulnerability primarily impacts confidentiality by exposing personal location tracking data. No verified exploit code has been published. Details are available in the CISA Vulnerability Advisory.

Detection Methods for CVE-2026-9219

Indicators of Compromise

Unexpected enrollment events on Setracker2 accounts not initiated by the legitimate owner
Repeated enrollment API requests from a single source with sequential or enumerated identifier values
Watches reporting location or command traffic to unfamiliar accounts or endpoints

Detection Strategies

Monitor Setracker2 backend enrollment logs for high-volume registration attempts targeting distinct IMEIs from the same client
Correlate enrollment events with subsequent geographic anomalies in watch telemetry that suggest new controller devices
Alert on Android devices running com.tgelec.setracker at version 3.1.5 or earlier through mobile device management inventory reports

Monitoring Recommendations

Track enrollment API rate and rejection patterns to identify identifier enumeration attempts
Review account audit trails for watches added without corresponding user-initiated pairing flows
Ingest mobile application inventory data into a centralized log platform for version-based risk queries

How to Mitigate CVE-2026-9219

Immediate Actions Required

Inventory all devices running com.tgelec.setracker and identify installations at version 3.1.5 or earlier
Review Setracker2 account enrollment history for unrecognized watch bindings and remove unauthorized entries
Restrict distribution or exposure of IMEI values on packaging, receipts, and support communications

Patch Information

No vendor patch has been referenced in the published advisory. Consult the CISA Vulnerability Advisory for updates from the vendor regarding a fixed release.

Workarounds

Discontinue use of Setracker2-managed watches for sensitive tracking scenarios until the enrollment flow is hardened with additional authentication
Use network controls to limit which client sources can reach the Setracker2 enrollment API where feasible
Rotate device ownership by physically re-pairing watches and monitoring for unauthorized re-enrollment attempts

bash

# Configuration example
# Query Android mobile inventory for vulnerable Setracker2 installations
adb shell pm list packages | grep com.tgelec.setracker
adb shell dumpsys package com.tgelec.setracker | grep versionName