CVE-2026-9222

The application, when logging into backend services, transmits only the hash of the user's password, without applying additional verification mechanisms (e.g., challenge-response). This means the hash serves as an authenticating identity — it is sufficient to intercept it or obtain it from another source (e.g., database leak, network traffic sniffing). An attacker who possesses the hash can directly authenticate in the application's backend and take over the victim's account (pass-the-hash attack).

An attacker who knows the user's password hash can authenticate in the Setracker2 backend and gain full access to the account, including tracking data and device management associated with the application.

Apply patches available from the manufacturer according to the references. It is recommended to update the application to a version newer than 3.1.5, which should implement a secure authentication mechanism that does not rely solely on password hash transmission.

Setracker2 application for Android (com.tgelec.setracker) in version 3.1.5 and earlier.