The vulnerability in Traccar Client (<=9.7.19) involves improper verification of the source of a communication channel (CWE-940). The app registers a custom deep link scheme that allows an attacker to supply parameters such as server URL, device ID, accuracy, distance, and interval. When a victim taps a crafted deep link (via SMS, email, webpage, or other apps), the app silently writes these parameters into its persistent configuration without any user interaction or visual indication. This enables an attacker to hijack all GPS tracking data and redirect it to their own server at maximum precision and frequency. The vulnerability is resolved in version 9.7.20.

An attacker can covertly redirect all GPS telemetry from the victim's device to an attacker-controlled server, gaining continuous, real-time location tracking. This compromises user privacy and location confidentiality. The attack requires only that the victim taps a crafted deep link, with no special permissions needed. The change persists across app restarts, making the compromise long-lasting until the app is updated or reconfigured.

This vulnerability is fixed in Traccar Client version 9.7.20. Users and administrators should upgrade to version 9.7.20 or later to remediate this issue. Until then, users should avoid tapping untrusted deep links using the org.traccar.client://config scheme. Patch status is not explicitly confirmed by a vendor advisory in the provided data, but the fix version is stated in the description.