VulnerabilityDeferred

CVE-2026-9219

If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

HIGH 8.3EPSS 0.35%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

CVSS 4.0: 8.3 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.35% probability · 28th percentile
CISA KEV: Not listed
Weakness: CWE-340
Source: ics-cert@hq.dhs.gov

References

https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.