CVE-2026-9221 identifies a cryptographic weakness in the Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier, where MD5 is used to generate request signatures for authenticating client-server communications. MD5 is considered broken and vulnerable to collision and preimage attacks, enabling attackers to reverse the signature and recover session IDs. This exposure allows attackers to impersonate users and perform authenticated API requests without authorization. The vulnerability is rated high severity (CVSS 8.7) and no official fix or patch has been documented in the vendor advisory or other sources.

Attackers can exploit the weak MD5-based signature mechanism to recover session IDs, enabling user impersonation and unauthorized authenticated API requests. This compromises the confidentiality and integrity of user sessions and potentially allows unauthorized access to user data or control over the parental control app functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious about using affected versions and monitor for vendor updates. No official remediation or temporary fix has been documented.