Log in Start free

Vulnerability · Published Jun 25, 2026 · Assigned by icscert

CVE-2026-9219Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers

Medium 6.5

In plain English

A medium-severity security flaw in Setracker2 Parental Control App (Android) package com.tgelec.setracker from Shenzhen i365-Tech Co. Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 71.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

Affected products (as reported)

VendorProductVersions
Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker 0 – through 3.1.5

Weakness: CWE-340 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References