CVE-2026-9219/9220/9221/9222: Multiple High-Severity Vulnerabilities in Settracker2 Android App

Vulnerability Overview Vulnerability Name: Settracker2 Child Smartwatch Ecosystem Vulnerability IDs: CVE-2026-9219, CVE-2026-9220, CVE-2026-9221, CVE-2026-9222 Vulnerability Description: The Settracker2 Android Companion App versions 3.1.5 and earlier contain multiple security vulnerabilities, including predictable registration IDs, hardcoded encryption keys, request signatures generated using MD5, and authentication based solely on password hashing. Affected Scope Affected Product: Settracker2 Parental Control App (Android) package Affected Versions: 3.1.5 and earlier Impact Description: - CVE-2026-9219: Predictable registration IDs allow attackers to obtain registration IDs, thereby enabling the arbitrary registration of devices belonging to other users. - CVE-2026-9220: Hardcoded encryption keys allow attackers to decrypt Settracker2 smartwatch traffic. - CVE-2026-9221: Request signatures generated using MD5 allow attackers to forge legitimate users and initiate authenticated API requests. - CVE-2026-9222: Authentication relying solely on password hashing allows attackers to obtain the hash and gain full access to the service. Remediation Current Status: The vendor has not responded to CISA's coordination attempts; no known fix is available. Recommended Actions: Affected users should contact the vendor or their local distributor for further information. References CISA Security Alert CISA Recommended Practices CISA Cybersecurity Best Practices CISA Industrial Control Systems Security CISA Email Scams CISA Cybersecurity Events CISA Recommended Practices CISA Cybersecurity Events CISA Cybersecurity Events CISA Cybersecurity Events Scoring CVSS v3.1: - CVE-2026-9219: Base Score 6.5, Severity MEDIUM - CVE-2026-9220: Base Score 7.5, Severity HIGH - CVE-2026-9221: Base Score 7.5, Severity HIGH - CVE-2026-9222: Base Score 7.5, Severity HIGH Additional Information Release Date: 2026-06-25T06:00:00.000000Z Revision History: Initial Release Status: Final Version: 1

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-9219/9220/9221/9222: Multiple High-Severity Vulnerabilities in Settracker2 Android App