CVE-2026-9219
Description
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.
Summary dbcve.org
The Setracker2 Android Companion App versions 3.1.5 and prior uses a predictable registration ID mechanism derived from the device IMEI. The enrollment system fails to require additional authentication before assigning a watch to a user account, allowing an attacker who obtains a valid registration ID to hijack and arbitrarily enroll watches belonging to other users.
Mitigation
Replace the IMEI-derived registration ID with a cryptographically random identifier and implement multi-factor or additional authentication (e.g., device ownership verification, OTP, or binding confirmation) before allowing watch assignment to prevent unauthorized enrollment.