The Setracker2 Android Companion App, versions 3.1.5 and prior, accepts a password hash instead of an actual password when authenticating with backend services. If an attacker learns this hash, they can authenticate as any user and gain full access to the application’s functionalities and the device it controls. This flaw allows unauthorized control over a smartwatch and the data it manages, which could expose personal information and allow manipulation of the device’s parental controls.

Shenzhen i365-Tech Co. Ltd.’s Setracker2 Parental Control App for Android (package com.tgelec.setracker). Affected versions are 3.1.5 and all earlier releases.

The CVSS score of 9.2 indicates high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to obtain the password hash, for example by reverse‑engineering the app or intercepting network traffic. Once the hash is known, authentication succeeds without the actual password, giving full account privileges. The risk is therefore significant, but exploitation depends on the attacker’s ability to acquire the hash.