High severity7.5NVD Advisory· Published Jun 26, 2026· Updated Aug 3, 2026
CVE-2026-9221
CVE-2026-9221
Description
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the session ID exposed, an attacker could impersonate the legitimate user and issue authenticated API requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=3.1.5
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.