CVE-2026-9220CWE-321

CVE-2026-9220

High · published June 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-06-26T04:16Z
References (1)
https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json · [email protected]
EPSS history
Timeline
  • 25 JUN 23:13Z
    Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key
    cvelistv5