Vulnerability · Published Jun 25, 2026 · Assigned by icscert
CVE-2026-9222Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication
High 8.1
In plain English
A high-severity security flaw in Setracker2 Parental Control App (Android) package com.tgelec.setracker from Shenzhen i365-Tech Co. Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 64.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen i365-Tech Co. Ltd. | Setracker2 Parental Control App (Android) package com.tgelec.setracker | 0 – through 3.1.53.4.1 |
Weakness: CWE-836 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H