CVE-2024-36554

Critical

Published: 06 February 2025

Published

06 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0013 32.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-36554 is a critical-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Diva Portal (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 32.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Limits specific unauthenticated actions like responding to SMS with sensitive device information, directly preventing exploitation without identification or authentication.

SI-15 Information Output Filtering good match

prevent

Filters sensitive information from output transmitted in SMS responses to block unauthorized disclosure of device data.

SI-10 Information Input Validation good match

prevent

Validates incoming SMS inputs to prevent processing of messages that trigger the return of sensitive device information.

NVD Description

Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allow a malicious user to gain information about the device by sending an SMS to the device which returns sensitive information.

Deeper analysisAI

CVE-2024-36554 affects two specific firmware versions of Forever KidsWatch devices: the Call Me KW-50 running R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and the Call Me KW-60 running R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b. The vulnerability enables a malicious user to obtain sensitive information about the device by sending an SMS message, which prompts the device to return that data. It is rated critical with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The CVE was published on 2025-02-06.

Any remote attacker can exploit this vulnerability without authentication, privileges, or user interaction by simply sending an SMS to the targeted device. Successful exploitation allows the attacker to retrieve sensitive device information, with high impacts on confidentiality, integrity, and availability as indicated by the CVSS vector.

A referenced research document details exploiting vulnerabilities, including this one, to remotely hijack children's smartwatches, available at https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296. No vendor advisories or patches are detailed in available information.