CVE-2024-36554
Published: 06 February 2025
Summary
CVE-2024-36554 is a critical-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability in Diva Portal (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Information Discovery (T1082); ranked at the 32.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-36554 affects two specific firmware versions of Forever KidsWatch devices: the Call Me KW-50 running R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and the Call Me KW-60 running R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b. The vulnerability enables a malicious user to obtain sensitive information about the device by sending an SMS message, which prompts the device to return that data. It is rated critical with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The CVE was published on 2025-02-06.
Any remote attacker can exploit this vulnerability without authentication, privileges, or user interaction by simply sending an SMS to the targeted device. Successful exploitation allows the attacker to retrieve sensitive device information, with high impacts on confidentiality, integrity, and availability as indicated by the CVSS vector.
A referenced research document details exploiting vulnerabilities, including this one, to remotely hijack children's smartwatches, available at https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296. No vendor advisories or patches are detailed in available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5065
Vulnerability details
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allow a malicious user to gain information about the device by sending an SMS to the device which returns sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables remote unauthenticated retrieval of sensitive device/system data via SMS, mapping to system information discovery and data collection from local system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Limits specific unauthenticated actions like responding to SMS with sensitive device information, directly preventing exploitation without identification or authentication.
Filters sensitive information from output transmitted in SMS responses to block unauthorized disclosure of device data.
Validates incoming SMS inputs to prevent processing of messages that trigger the return of sensitive device information.