CVE-2026-9219 is a vulnerability in the Setracker2 Parental Control App for Android (package com.tgelec.setracker) where the registration ID generation is predictable because it is derived directly from the IMEI number. The enrollment process lacks further authentication checks before assigning registration IDs, enabling an attacker with knowledge of a registration ID to enroll devices (watches) of other users arbitrarily. This vulnerability is categorized under CWE-340 (Generation of Predictable Numbers or Identifiers). The CVSS 4.0 base score is 8.3, indicating high severity with network attack vector, low attack complexity, and no privileges or user interaction required.

An attacker who obtains a predictable registration ID can enroll watches belonging to other users without authorization. This compromises the integrity of the enrollment system and potentially allows unauthorized access or control over devices linked to other users. The vulnerability could lead to privacy violations and unauthorized monitoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, users and administrators should be aware of the risk of predictable registration IDs and consider limiting exposure of IMEI numbers or registration IDs. Monitor vendor communications for updates on remediation.