CVE-2026-9219: Setracker2 Smartwatch Enrollment Hijacking via Predictable Registration ID

Technical summary

CVE-2026-9219 stems from weak entropy in the registration ID generation mechanism within com.tgelec.setracker. The ID is derived directly from device IMEI without cryptographic randomization, making it deterministic and reversible. The enrollment endpoint accepts registration requests without proof of device ownership (e.g., out-of-band confirmation, PIN verification, or crypto challenge). An attacker with knowledge of a target device's IMEI can compute the corresponding registration ID and submit an enrollment request that will be accepted, leading to unauthorized device association in the attacker's account.

Business impact

Organizations and individuals relying on Setracker2 for watch fleet management or personal device tracking face unauthorized access risks. An attacker could monitor, control, or intercept data from a watch without the legitimate owner's knowledge. For enterprises using these devices for employee tracking or health monitoring, a breach could expose location data, health metrics, and user activity. The vulnerability also undermines trust in the enrollment process, potentially affecting customer retention and regulatory compliance if sensitive personal data is exposed.

Affected systems

Setracker2 Android Companion App (com.tgelec.setracker) version 3.1.5 and all earlier versions are vulnerable. The vulnerability exists in the registration and enrollment subsystem and affects any user or organization running these versions on Android devices paired with compatible smartwatches.

Exploitability

Exploitation requires the attacker to obtain or derive a valid registration ID. This involves either social engineering or technical reconnaissance to identify a target device's IMEI. Once the IMEI is known, computing the registration ID is straightforward. Network access and the ability to reach the enrollment endpoint are required, both of which are accessible to remote attackers. The CVSS score of 6.5 (Medium) reflects the need for some level of preparation (AC:H), but no user interaction or special privileges are required once an ID is obtained.

Remediation

Update Setracker2 to a version after 3.1.5 that implements cryptographically secure, random registration IDs and enforces authentication during enrollment (e.g., email verification, SMS confirmation, or device-based proof-of-ownership challenge). Verify with the vendor that the patched version includes protection against ID prediction and spoofing. Until patching is possible, consider restricting app usage to trusted networks or disabling remote enrollment features if the application supports such controls.

Patch guidance

Check the vendor's advisory and release notes for versions after 3.1.5. Install patches through the Google Play Store or your organization's mobile device management (MDM) platform. If you manage Setracker2 devices via MDM, enforce minimum app version policies to prevent rollback to vulnerable versions. Test the patched version in a non-production environment first to confirm compatibility with your watch models and data synchronization workflows.

Detection guidance

Monitor enrollment logs for unusual registration activity, such as multiple devices registering under the same user account within a short timeframe, or registrations from unexpected IP addresses or geographies. If enrollment is visible in your app's settings or account history, regularly audit paired devices and confirm they are legitimate and expected. On the network side, look for repeated enrollment API calls with varying device identifiers or from suspicious sources. Endpoint detection and response (EDR) solutions may flag suspicious app behavior if the compromised app attempts to exfiltrate location or health data.

Why prioritize this

Although the CVSS score is Medium, the attack vector is network-accessible, no user interaction is required once an ID is obtained, and the impact includes high confidentiality loss (C:H). The vulnerability directly undermines the trust model of a device management system. Organizations managing fleets of smartwatches or relying on accurate device ownership records should prioritize patching to prevent unauthorized access and data exposure.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with high confidentiality impact (location and health data exposure) and low integrity impact (device control). The complexity is rated high (AC:H) because the attacker must first obtain or deduce the IMEI, introducing some friction. However, the score does not account for the reputational damage or regulatory implications of smartwatch hijacking in enterprise or healthcare contexts, which may warrant treating this as higher priority in practice.

Frequently asked questions