PT-2025-5848 · Forever · Forever Kidswatch Call Me Kw50+1

Lage Linusson-Hahn + 1 · Published 2025-02-06 · Updated 2025-02-06 · CVE-2024-36557

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Forever KidsWatch Call Me KW50 R36 YDR A3PW GM7S V1.0 2019 07 15 16.19.24 cob h Forever KidsWatch Call Me 2 KW60 R36CW YDE S4 A29 2 V1.0 2023.05.24 22.49.44 cob b

Description: The issue is related to the device ID being based on the IMEI. If a malicious user changes the IMEI to the IMEI of a unit they registered in the mobile app, it is possible to hijack the device and control it from the app.

Recommendations: For Forever KidsWatch Call Me KW50 R36 YDR A3PW GM7S V1.0 2019 07 15 16.19.24 cob h, consider implementing an additional authentication mechanism to prevent unauthorized access. For Forever KidsWatch Call Me 2 KW60 R36CW YDE S4 A29 2 V1.0 2023.05.24 22.49.44 cob b, restrict access to the device ID and IMEI information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-36557

Affected Products

Forever Kidswatch Call Me 2 Kw60

Forever Kidswatch Call Me Kw50

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-36557 · Security Note
• https://diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296 · Note
• https://twitter.com/CVEnew/status/1887559511356977256 · Twitter Post
• https://t.me/cvedetector/17405 · Telegram Post