CVE-2026-9220 describes a cryptographic vulnerability in the Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and prior. The app encrypts requests between the watch and backend using static, hardcoded AES keys and initialization vectors, violating secure cryptographic practices (CWE-321). This flaw enables attackers to decrypt intercepted traffic, compromising confidentiality. The vulnerability has a high CVSS 4.0 score of 8.7, indicating network exploitable with no privileges or user interaction required, and high impact on confidentiality. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An attacker able to intercept network traffic between the Setracker2 watch and backend can decrypt the communications due to the use of hardcoded static AES keys and IVs. This compromises the confidentiality of data exchanged, potentially exposing sensitive user information. The vulnerability does not require privileges or user interaction to exploit and has a high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should consider limiting exposure of the affected app's network traffic and monitor for updates from Shenzhen i365-Tech Co. Ltd. No official remediation or temporary fix has been published at this time.