The Setracker2 Parental Control App (Android) package com.tgelec.setracker versions 3.1.5 and prior authenticate users by accepting the password hash rather than the original password. This means that possession of the password hash is sufficient to authenticate with backend services, effectively bypassing password secrecy. The vulnerability is identified as CWE-836 (Use of password hash instead of password for authentication). No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An attacker who obtains a valid password hash can authenticate to the backend services as the legitimate user without needing the original password. This grants the attacker full access to the user account and associated functionalities within the app, potentially compromising user data and control features.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious about the security of their password hashes and avoid sharing or exposing them. Monitoring for vendor updates is recommended.