The Setracker2 Parental Control App (Android) package com.tgelec.setracker versions 3.1.5 and prior employs static, hardcoded AES encryption keys and initialization vectors for securing communications between the watch device and its backend server. This practice violates secure cryptographic key management principles (CWE-321), enabling attackers to decrypt intercepted traffic. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, and no privileges or user interaction required. No vendor advisory or patch information is currently available, and the app is not a cloud service, so remediation depends on vendor action or app updates.

An attacker capable of intercepting network traffic between the Setracker2 watch and backend can decrypt the communications due to the use of hardcoded static AES keys and IVs. This compromises the confidentiality of data transmitted by the watch, potentially exposing sensitive user information. The vulnerability does not require privileges or user interaction to exploit and can be executed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting use of affected versions and monitor for vendor updates. No official or temporary fixes are currently documented.