CVE-2024-36555

Critical

Published: 06 February 2025

Published

06 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0011 29.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-36555 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Diva Portal (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-4 (Identifier Management).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

AC-14 directly prohibits unauthenticated access to critical functions like the SMS-configuration command that enables IMEI modification.

IA-4 Identifier Management good match

prevent

IA-4 mandates protection of system identifiers such as IMEI from unauthorized modification, preventing device identity forgery.

IA-3 Device Identification and Authentication partial match

prevent

IA-3 requires unique device identification and authentication, mitigating the effects of IMEI forgery on network communications.

NVD Description

Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allows malicious users to change the device IMEI-number which allows for forging the identity of the device.

Deeper analysisAI

CVE-2024-36555 affects the built-in SMS-configuration command in two specific firmware versions of children's smartwatches: Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b. Classified under CWE-306 (Missing Authentication for Critical Function), the vulnerability enables unauthorized modification of the device's IMEI number, allowing attackers to forge the device's identity on cellular networks. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high impacts on confidentiality, integrity, and availability.

Any remote attacker can exploit this vulnerability without authentication, privileges, or user interaction by leveraging the unauthenticated SMS-configuration command. Successful exploitation allows changing the IMEI number, enabling device identity forgery, which could facilitate impersonation in network communications or tracking systems.

The sole reference points to a DIVA portal record titled "Exploiting Vulnerabilities to Remotely Hijack Children’s Smartwatches," which details the issue but provides no explicit mitigation steps, patches, or vendor advisories in the available information. Security practitioners should isolate affected devices and monitor for unauthorized SMS commands until firmware updates are confirmed.