CVE-2026-9222
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier only require a password hash for authentication. If an attacker obtains that hash, they can log in as any user and gain full access to the app’s backend services.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Android users of the Setracker2 Companion App, specifically versions 3.1.5 and earlier.
Real-world impact
An attacker who learns a user’s password hash can authenticate to the backend and take full control of the user’s account, potentially accessing personal data and performing any actions the user can.
Why this severity
The CVSS score of 9.2 reflects a high impact on confidentiality, integrity, and availability, with the attack possible over the network, low complexity, and no user interaction required. The vulnerability allows full access once the hash is known, leading to a critical security risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 26, 2026 · Jun 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Aug 3, 2026 · 9h agoAdvisory updatedThe NVD record was last revised.