CVE-2024-36556

Executive Summary

CVE-2024-36556 exposes a critical hardcoded password vulnerability in two models of Forever KidsWatch smartwatches: the Call Me KW50 and Call Me 2 KW60. These devices, designed for children, contain embedded credentials that are identical across all units of the same model and cannot be changed by the end user. An attacker with network access to the watch (e.g., via Bluetooth or the companion mobile app) can leverage these hardcoded credentials to gain unauthorized administrative control, potentially accessing sensitive data such as GPS location, call logs, and contact lists, or even sending commands to the device. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and aligns with MITRE ATT&CK tactic T1078.001 (Valid Accounts: Default Accounts). No official patch has been released by the vendor, Forever, leaving all affected devices permanently at risk.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in proprietary IoT hardware. The risk propagates through the supply chain as these devices are sold to consumers and potentially distributed through retail channels without any mechanism for credential rotation or firmware updates.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates that a full vector has not been assigned. However, based on the nature of the vulnerability, a reasonable assessment would be:

• Attack Vector (AV): Adjacent Network (A) – Exploitation requires proximity to the device (e.g., Bluetooth range).
• Attack Complexity (AC): Low (L) – The hardcoded password is static and easily obtainable from firmware analysis.
• Privileges Required (PR): None (N) – No prior authentication is needed.
• User Interaction (UI): None (N) – Exploitation does not require user action.
• Scope (S): Unchanged (U) – The vulnerable component is the device itself.
• Confidentiality (C): High (H) – Full access to device data (location, contacts, call logs).
• Integrity (I): High (H) – Ability to send commands, modify settings, or disable the device.
• Availability (A): High (H) – Potential to brick the device or disrupt its functionality.

Estimated CVSS v3.1 Score: 8.8 (High)

Threat Level: High. The vulnerability is trivial to exploit, affects a vulnerable population (children), and has no available patch.

Deep Dive & Mechanics

The vulnerability stems from the firmware of the Forever KidsWatch devices. The hardcoded password is embedded in the firmware binary and is identical across all units of the same model. This password is used for authentication between the watch and the companion mobile application, as well as for over-the-air (OTA) update mechanisms and debug interfaces.

Technical Details:

• Affected Firmware Versions:
  • KW50: R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h
  • KW60: R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b
• Attack Vector: An attacker within Bluetooth range (typically up to 10 meters) can pair with the watch using the hardcoded credentials. Alternatively, if the watch is connected to a Wi-Fi network, the attacker could potentially exploit the companion app's cloud backend if the same credentials are used there.
• Impact: Once authenticated, the attacker can:
  • Retrieve real-time GPS coordinates.
  • Access call history and contact lists.
  • Initiate or intercept calls.
  • Send commands to the watch (e.g., change settings, trigger alarms).
  • Potentially push malicious firmware updates.

Vulnerable vs. Patched Code

Since this is a firmware-level vulnerability, there is no traditional "code" to compare. The vulnerability is the presence of a hardcoded password string in the firmware binary.

Vulnerable Firmware (KW50):

• The firmware image contains a string like "admin_password=123456" (example) that is used for authentication.
• This string is not encrypted or obfuscated and can be extracted using tools like binwalk or strings.

Patched Firmware (None available):

• A patched version would remove the hardcoded credential and implement a secure pairing mechanism, such as:
  • A unique, randomly generated password set during initial setup.
  • Public-key cryptography for authentication.
  • A secure key exchange protocol (e.g., Bluetooth LE Secure Connections).

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Hardware: Forever KidsWatch KW50 or KW60 (fully charged).
2. Software:
   • Kali Linux or any Linux distribution with Bluetooth tools.
   • bluetoothctl for Bluetooth pairing.
   • gattool or gatttool for BLE GATT operations.
   • Custom Python script using bluepy or pygatt library.
3. Network: Bluetooth adapter (internal or USB dongle).

Exploitation Steps:

1. Discover the device:

   sudo bluetoothctl
   scan on
   

   Identify the watch's MAC address (e.g., AA:BB:CC:DD:EE:FF).

2. Pair using hardcoded password:

   sudo bluetoothctl
   pair AA:BB:CC:DD:EE:FF
   # Enter the hardcoded password when prompted (e.g., "123456")
   

3. Connect and enumerate services:

   sudo gatttool -b AA:BB:CC:DD:EE:FF -I
   connect
   primary
   characteristics
   

4. Read sensitive data (e.g., GPS location):

   # Example Python script using bluepy
   from bluepy import btle
   import binascii
   
   device = btle.Peripheral("AA:BB:CC:DD:EE:FF")
   # Assume GPS data is on characteristic UUID 0x2A67
   gps_char = device.getCharacteristics(uuid="00002a67-0000-1000-8000-00805f9b34fb")[0]
   gps_data = gps_char.read()
   print("GPS Data:", binascii.hexlify(gps_data))
   

Blue Team (Defensive)

Detection and Response:

1. Network Monitoring: Monitor for unusual Bluetooth pairing requests from unknown devices. Use a Bluetooth sniffer (e.g., Ubertooth) to capture and analyze BLE traffic.
2. Device Hardening: If possible, isolate the watch on a separate VLAN with strict firewall rules. Disable unnecessary Bluetooth services.
3. User Awareness: Inform parents/caregivers about the risk and advise them to:
   • Keep the watch in a secure location when not in use.
   • Monitor the companion app for unauthorized access.
   • Disable Bluetooth when not needed (if the device allows).
4. Firmware Updates: Check the vendor's website periodically for any security updates. If none are available, consider replacing the device.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual Bluetooth pairing requests from unknown MAC addresses.
  • Repeated failed authentication attempts on the watch's BLE interface.
  • Unexpected data exfiltration from the watch (e.g., GPS coordinates sent to an unknown IP).

• Host IOCs (on the watch):

  • Presence of the hardcoded password string in firmware dumps:
    • KW50: R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h
    • KW60: R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b
  • Unauthorized changes to device settings (e.g., alarm times, contact list).

• File IOCs:

  • Firmware hash (SHA256):
    • KW50: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder)
    • KW60: a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a (placeholder)

Detection Engineering

YARA Rule

rule CVE_2024_36556_Forever_KidsWatch_Hardcoded_Password {
    meta:
        description = "Detects hardcoded password strings in Forever KidsWatch firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36556"
        hash_kw50 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
        hash_kw60 = "a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a"
    strings:
        $kw50_fw = "R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h"
        $kw60_fw = "R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b"
        $password = "hardcoded_password_placeholder"  // Replace with actual extracted password
    condition:
        any of ($kw50_fw, $kw60_fw) or $password
}

Sigma Rule

title: Detection of Forever KidsWatch Hardcoded Password Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Bluetooth pairing attempts using hardcoded credentials on Forever KidsWatch devices
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36556
logsource:
    product: linux
    service: bluetooth
detection:
    selection:
        EventID: 1000  # Example: Bluetooth pairing event
        Target: "AA:BB:CC:DD:EE:FF"  # Replace with watch MAC
        Credential: "hardcoded_password_placeholder"
    condition: selection
falsepositives:
    - Legitimate pairing by the owner
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-36556 Forever KidsWatch Hardcoded Password Exploitation"; content:"hardcoded_password_placeholder"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disconnect from untrusted networks: If the watch is connected to Wi-Fi, disable that feature and rely only on Bluetooth for local communication.
2. Monitor the companion app: Regularly check for unauthorized devices paired with the watch.
3. Physical security: Keep the watch in a secure location when not in use to prevent physical access.

Long-term Solutions:

1. Vendor patch: Contact Forever (the vendor) and demand a firmware update that removes the hardcoded password and implements secure pairing.
2. Device replacement: If no patch is available, consider replacing the device with a more secure alternative from a vendor with a proven security track record.
3. Network segmentation: Place IoT devices like this on a separate VLAN with strict access controls.

Workaround:

• If the device allows, change the Bluetooth PIN/password through the companion app (if such an option exists). However, this is unlikely given the nature of the vulnerability.

Valters IT