CVE-2024-36554

Executive Summary

CVE-2024-36554 exposes a critical information disclosure vulnerability in the Forever KidsWatch Call Me KW-50 and KW-60 smartwatches. By sending a specially crafted SMS to the device, an unauthenticated attacker can retrieve sensitive device information, including potentially location data, device identifiers, and configuration details. This vulnerability is particularly concerning as it targets children's smartwatches, posing a significant privacy and safety risk. The vendor has not released a patch, and no official advisory is available.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an IoT device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a more realistic assessment would be:

• Attack Vector (AV): Network (AV:N) - The attack is performed via SMS, which is a network-based communication channel.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required; the attacker only needs to know the device's phone number.
• Privileges Required (PR): None (PR:N) - No authentication is needed.
• User Interaction (UI): None (UI:N) - The victim does not need to perform any action.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) - Sensitive device information is disclosed.
• Integrity (I): None (I:N) - No data modification is possible.
• Availability (A): None (A:N) - No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Score: 7.5 (High)

Threat Level: High. The ease of exploitation and the target demographic (children) elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in the SMS handling logic of the Forever KidsWatch Call Me KW-50 and KW-60 firmware. The devices are designed to receive commands via SMS for parental control features. However, the firmware fails to properly authenticate or sanitize incoming SMS messages.

Mechanism:

1. The attacker obtains the phone number associated with the target smartwatch.
2. The attacker sends an SMS containing a specific command string (likely a proprietary protocol or a simple keyword like "INFO" or "GETSTATUS").
3. The device's firmware parses the SMS and, without verifying the sender's identity, executes the command.
4. The command triggers the device to compile and return sensitive information (e.g., IMEI, SIM card details, current GPS coordinates, firmware version, battery status) via an SMS reply to the attacker's number.

The lack of sender authentication is the core flaw. The device should only respond to SMS from pre-authorized parent numbers.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, a secure implementation would include:

Vulnerable (Conceptual):

void handle_incoming_sms(char *sender, char *message) {
    // No sender validation
    if (strcmp(message, "GETINFO") == 0) {
        send_sms(sender, get_device_info());
    }
}

Patched (Conceptual):

void handle_incoming_sms(char *sender, char *message) {
    if (!is_authorized_parent(sender)) {
        return; // Ignore unauthorized senders
    }
    if (strcmp(message, "GETINFO") == 0) {
        send_sms(sender, get_device_info());
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A GSM modem or an SMS gateway service (e.g., Twilio, ClickSend).
• The target device's phone number.
• Knowledge of the command syntax (likely discoverable via firmware analysis or public forums).

Exploitation Steps:

1. Reconnaissance: Obtain the target device's phone number (e.g., via social engineering, OSINT, or if the number is publicly shared).
2. Command Discovery: Analyze the device firmware (if obtainable) or search online forums for the SMS command set. Common commands might include INFO, STATUS, LOCATION, IMEI.
3. Exploitation: Send an SMS to the target number with the discovered command.

   # Example using a GSM modem (AT commands)
   AT+CMGS="+1234567890"
   > GETINFO
   <Ctrl+Z>
   

4. Exfiltration: The device will reply with an SMS containing the requested information.

Proof of Concept (Python using Twilio):

from twilio.rest import Client

# Your Account SID and Auth Token from twilio.com/console
account_sid = 'your_account_sid'
auth_token = 'your_auth_token'
client = Client(account_sid, auth_token)

message = client.messages.create(
    body='GETINFO',
    from_='+1234567890',  # Your Twilio number
    to='+0987654321'      # Target device number
)

print(message.sid)

Blue Team

Detection & Prevention:

• Network Monitoring: Monitor SMS gateways for unusual outbound SMS traffic to known smartwatch numbers.
• Device Hardening: If possible, configure the device to only accept SMS from whitelisted numbers (this may not be possible without a vendor patch).
• User Education: Advise parents to keep the device's phone number private and to monitor for unexpected SMS replies.
• Firmware Updates: Check the vendor's website for any firmware updates that might address this issue.

Indicators of Compromise (IOCs)

• Network:
  • Outbound SMS from a device to an unknown number containing strings like IMEI:, LOC:, BAT:.
  • SMS messages sent to the device with commands like GETINFO, STATUS, LOCATION.
• Host (Device):
  • Unexpected SMS replies containing device configuration data.
  • Increased SMS activity from the device.
• File System (Firmware Analysis):
  • Presence of unauthenticated SMS command handlers in the firmware binary.

Detection Engineering

YARA Rule

rule Detect_KidsWatch_SMS_Exploit {
    meta:
        description = "Detects SMS commands used to exploit CVE-2024-36554"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-36554"
    strings:
        $cmd1 = "GETINFO" ascii wide nocase
        $cmd2 = "STATUS" ascii wide nocase
        $cmd3 = "LOCATION" ascii wide nocase
        $cmd4 = "IMEI" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: SMS Exploitation of Forever KidsWatch (CVE-2024-36554)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SMS messages sent to a Forever KidsWatch device that may be exploiting CVE-2024-36554.
author: Valters IT
date: 2024-10-27
logsource:
    product: generic
    service: sms_gateway
detection:
    selection:
        MessageBody|contains:
            - 'GETINFO'
            - 'STATUS'
            - 'LOCATION'
            - 'IMEI'
        Recipient|contains: 'KidsWatch'
    condition: selection
falsepositives:
    - Legitimate parental commands (if whitelisting is not enforced)
level: high

Suricata Rule

alert sms any any -> any any (msg:"CVE-2024-36554 Forever KidsWatch SMS Information Disclosure"; content:"GETINFO"; nocase; content:"STATUS"; nocase; content:"LOCATION"; nocase; content:"IMEI"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SMS Command Feature: If the device allows, disable the SMS command feature entirely through the companion app.
2. Change Device Number: If possible, change the SIM card and phone number associated with the device.
3. Monitor Device Activity: Regularly check the device's SMS log for any suspicious messages.

Long-Term Solutions:

1. Vendor Patch: The vendor must release a firmware update that implements sender authentication (whitelisting) for SMS commands.
2. Network-Level Filtering: Mobile carriers could implement filtering to block SMS messages containing known exploit commands to these devices.
3. Device Replacement: If no patch is forthcoming, consider replacing the device with a more secure alternative.

Workarounds:

• Use a separate, dedicated phone number for the device that is not publicly known.
• Set up a firewall on the device's network (if it uses Wi-Fi) to block outbound SMS traffic.

Valters IT