CVE-2026-9221 identifies a cryptographic weakness in the Setracker2 Android Companion App (com.tgelec.setracker) where MD5 is used to generate request signatures for authenticating client-server communications. MD5 is considered broken and vulnerable to collision and preimage attacks, enabling attackers to reverse the signature and extract session IDs. This exposure allows unauthorized impersonation of users by issuing authenticated API requests. The vulnerability affects versions up to 3.1.5. No official patch or remediation level has been published yet.

An attacker who successfully reverses the MD5-based request signature can recover session IDs, enabling them to impersonate legitimate users of the Setracker2 app. This can lead to unauthorized access to user accounts and potentially sensitive parental control data or functions. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious about using versions 3.1.5 and earlier. Monitoring vendor communications for updates or patches is recommended.