The vulnerability in the Setracker2 Android Companion App arises from the use of static hard‑coded AES keys and initialization vectors to encrypt communication between the child’s smartwatch and its backend. Because the keys never change, any party that can observe the network traffic can easily decrypt the data, leaking sensitive personal information such as location, communications, or device telemetry. This weakness allows an attacker to read confidential data that is intended to be protected, potentially enabling further exploitation.

Shenzhen i365‑Tech Co. Ltd. produces the Setracker2 Parental Control App for Android, package name com.tgelec.setracker. Versions 3.1.5 and earlier are affected. The vulnerability lies in the communication layer, so any device or user running these app releases on Android with a compatible smartwatch is potentially exposed.

The CVSS score of 8.7 reflects a high severity due to confidentiality impact and threat model. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a network‑based threat, as an attacker can intercept traffic between the watch and the cloud, and the public nature of the static key removes the need for local privileges. Consequently, the exposure can be achieved without special privileges, making it attractive to attackers who can sniff the traffic.