CVE-2024-36558

High

Published: 06 February 2025

Published

06 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0005 16.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-36558 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Diva Portal (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-8 Transmission Confidentiality and Integrity good match

prevent

SC-8 mandates cryptographic mechanisms to protect the confidentiality and integrity of information transmitted between the device and server, directly mitigating cleartext transmission of sensitive data.

SC-13 Cryptographic Protection good match

prevent

SC-13 requires implementation of cryptographic protections to prevent unauthorized disclosure of sensitive information during device-server communications.

SC-9 Transmission Confidentiality good match

prevent

SC-9 specifically enforces confidentiality protections for transmitted sensitive information, addressing the lack of encryption in the vulnerable communications.

NVD Description

Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication.

Deeper analysisAI

CVE-2024-36558 is a Cleartext Transmission of Sensitive Information vulnerability (CWE-319) affecting the Forever KidsWatch Call Me KW-50 device with firmware version R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h. The issue stems from the absence of encryption in communication between the device and its server, allowing sensitive data to be transmitted in plaintext. Published on 2025-02-06, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity primarily due to confidentiality impact.

Remote attackers with network access can exploit this vulnerability without authentication, privileges, user interaction, or special complexity. By intercepting traffic between the device and server, they can capture sensitive information transmitted in cleartext, potentially including location data, user identifiers, or other personal details from the children's smartwatch.

The sole reference points to a document on the DIVA portal titled "Exploiting Vulnerabilities to Remotely Hijack Children’s Smartwatches," which discusses vulnerabilities in such devices but provides no specific details on advisories, patches, or mitigation steps in the available information.