Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Forever KidsWatch Devices Leaked Device Info with SMS

CVE-2024-36554 · published 1 year ago
Summary

Two specific models of Forever KidsWatch devices can leak sensitive information to hackers if an attacker sends a malicious SMS to the device. This means that personal data about the device and its settings could be accessed without permission. To protect yourself, update to the latest firmware version for your device if available, and consider changing your device's SMS settings to limit who can send messages to it.

Original advisory text
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allow a malicious user to gain...
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allow a malicious user to gain information about the device by sending an SMS to the device which returns sensitive information.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere
Timeline
Published6 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-36554 · NVD
Track software like this
Free during beta