Executive brief
The Setracker2 Android app, used to manage children's smartwatches, uses weak security methods to protect communication between the watch and its servers. Because the app uses permanent, unchangeable security keys, an attacker could intercept and read private data sent between the watch and the parent's phone. This could lead to the exposure of sensitive location data or personal information about the child using the device.
Technical details
The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and prior utilize hardcoded, static AES keys and initialization vectors (IVs) for request encryption. This vulnerability (CWE-321) exists in the communication channel between the smartwatch hardware and the backend infrastructure. A remote attacker with the ability to intercept network traffic can use these publicly known or extracted static keys to decrypt the data stream. Successful exploitation results in a complete loss of confidentiality for the transmitted data, which typically includes GPS coordinates and device status. No user interaction or authentication is required to perform the decryption once traffic is captured.
Affected products
- Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker 3.1.5 and prior
Timeline
- 2026-06-25: advisory: CISA/ICS-CERT published advisory VA-26-176-01
- 2026-06-26: disclosed: NVD publication date