Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-9220 Static AES Encryption Keys in Setracker2 Android App Versions 3.1.5 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9220
Post summary
The post announces vulnerability CVE-2026-9220 involving static AES keys in Setracker2 Android app versions, but does not provide PoC, exploit, active usage, or patch details.
🚨*CVE* CVE-2026-9220 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and in… https://www.cve.org/CVERecord?id=CVE-2026-9220 ----- Traducción: CVE-2026-9220 Set… http://infoflow.cloud`
Post summary
The post announces CVE-2026-9220, noting that Setracker2 Android Companion App versions 3.1.5 and earlier store static hardcoded AES keys, but offers no PoC, exploit, or mitigation details.
CVE-2026-9220 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and in… https://www.cve.org/CVERecord?id=CVE-2026-9220
Post summary
The post describes a CVE involving hardcoded AES keys in the Setracker2 Android Companion App, without mentioning PoCs, exploits, or patches.