CVE-2026-9222: Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

Synopsis

This is an authentication bypass vulnerability in the Setracker2 Android companion app (com.tgelec.setracker version 3.1.5 and prior), part of the children's smartwatch ecosystem made by Shenzhen i365-Tech. The app authenticates to its backend services by sending only a password hash rather than a real password, meaning anyone who obtains the hash can log in without knowing the original password. Successful exploitation gives an attacker full authenticated access to the account, exposing children's location data and the ability to tamper with device settings. HarborGuard tracks this advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Setracker2 backend service over the network; the vulnerable authentication endpoint is exposed to internet-accessible infrastructure.

• AuthenticationNot required

  No valid password is required; possession of the victim account's password hash is sufficient to authenticate, and no privileged account is needed to begin the attack.

• Victim interactionNot required

  The attacker operates entirely against the backend API without requiring any action from the account owner or child device user.

• Attack complexityDetail

  Base exploit logic is condition-free and reliable, though the attacker requires a precondition of obtaining the target account's password hash (noted as AT:P in the vector), such as through a prior data leak or interception.

Blast Radius

• Reads the tracked GPS location history and real-time location of the child wearing the associated smartwatch.
• Reads account credentials, profile data, and any stored personal information tied to the parent and child accounts.
• Modifies device settings on the paired smartwatch, including geofence boundaries, contact lists, and SOS configuration.
• Disrupts the monitoring service by locking out the legitimate account holder or altering alert rules.