CVE-2026-9222 describes a vulnerability in Shenzhen i365-Tech Co. Ltd.'s Setracker2 Parental Control App for Android (package com.tgelec.setracker) where versions 3.4.1 and earlier authenticate users by requiring only the password hash rather than the original password. This allows an attacker who knows the hash to bypass authentication controls and gain full access to backend services. The vulnerability is categorized as CWE-836 (Use of password hash instead of password for authentication). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

An attacker who obtains the password hash can authenticate to backend services as the legitimate user without needing the original password. This can lead to full unauthorized access, potentially compromising user data and control functions within the parental control app. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about exposure of password hashes and consider limiting use or access to the affected app versions. Monitor official vendor channels for updates or patches addressing this vulnerability.