CVE-2026-9219 describes a vulnerability in the Setracker2 Parental Control App for Android (package com.tgelec.setracker) where the registration ID is derived predictably from the IMEI number. Because the enrollment system lacks further authentication checks, an attacker with knowledge of a registration ID can enroll devices (watches) belonging to other users arbitrarily. This vulnerability is categorized under CWE-340 (Generation of Predictable Numbers or Identifiers). The CVSS 4.0 base score is 8.3, indicating high severity, with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability was published on June 25, 2026. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker who obtains a predictable registration ID can enroll watches belonging to other users without authorization, potentially leading to unauthorized access or control over those devices. This compromises user privacy and device security. The vulnerability allows remote exploitation without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious about sharing registration IDs and monitor for suspicious enrollments. Additional authentication mechanisms should be implemented by the vendor to prevent unauthorized enrollment.