Medium severity6.5NVD Advisory· Published Jun 26, 2026· Updated Aug 3, 2026

CVE-2026-9219

Description

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Setracker2/Setracker2 Android Companion Appllm-fuzzy
Range: <=3.1.5
Setracker2/com.tgelec.setrackerllm-create
Range: <=3.1.5

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.jsonnvd

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.5/ 10

CVSS v48.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

Probability of exploitation in the next 30 days.

0.35%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-340
Generation of Predictable Numbers or Identifiers

CVE ID

CVE-2026-9219

Credits

HH
Huancheng Hu of Hasso Plattner Institute reported this vulnerability to CISA, with support from Prof. Christian Doerr.
finder