High severity8.1NVD Advisory· Published Jun 26, 2026· Updated Aug 3, 2026

CVE-2026-9222

Description

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Setracker2/Setracker2 Android Companion Appllm-fuzzy
Range: <=3.1.5

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.jsonnvd

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

8.1/ 10

CVSS v49.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

0.41%

VYPR risk score

Composite of severity, exploitation, and reach.

0.53high

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-836
Use of Password Hash Instead of Password for Authentication

CVE ID

CVE-2026-9222

Credits

HH
Huancheng Hu of Hasso Plattner Institute reported this vulnerability to CISA, with support from Prof. Christian Doerr.
finder