CVE-2024-36558

Executive Summary

CVE-2024-36558 exposes a critical security flaw in the Forever KidsWatch Call Me KW-50 smartwatch. The device transmits sensitive data (including location, voice recordings, and potentially authentication tokens) over the network in cleartext without any encryption (e.g., TLS/SSL). This allows any attacker with network access—on the same Wi-Fi, via a rogue access point, or through a compromised ISP—to passively intercept and read all communications between the watch and its backend servers.

The vulnerability is rooted in the firmware version R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h. The vendor, Forever, has not released a patch, and the product appears to be end-of-life. This report provides detection rules, exploitation guidance, and mitigation steps for defenders.

Supply Chain & Package Security

This is an embedded IoT device vulnerability, not a software package. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk lies in the device firmware and the unencrypted backend API endpoints.

CVSS Breakdown & Threat Level

While no official CVSS vector is assigned, based on the nature of the flaw:

• Attack Vector (AV): Network (Adjacent or Local) – attacker must be on the same network segment or have ability to sniff traffic.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed to sniff.
• User Interaction (UI): None – the watch communicates automatically.
• Scope (S): Unchanged – the compromise is within the watch’s communication channel.
• Confidentiality (C): High – all transmitted data is exposed.
• Integrity (I): None – data cannot be modified (only read).
• Availability (A): None – no denial of service.

Estimated CVSS Score: 7.5 (High) – due to high confidentiality impact and low attack complexity.

Deep Dive & Mechanics

The Forever KidsWatch KW-50 uses a proprietary protocol over TCP/UDP to communicate with its cloud backend. The firmware does not implement any encryption layer (no TLS, no custom encryption). All data—including:

• GPS coordinates
• Voice call audio
• SMS messages
• Device authentication tokens
• Parent app credentials (if transmitted)

—is sent as plaintext over the network.

Attack Scenario:

1. An attacker on the same Wi-Fi network as the watch (or a compromised router/ISP) uses a packet sniffer (e.g., Wireshark, tcpdump) to capture traffic.
2. The attacker filters for traffic to/from the watch’s IP or known backend server IPs.
3. Sensitive data is extracted directly from the payloads.

Root Cause: The firmware developer omitted encryption to reduce computational overhead or due to lack of security awareness. The protocol likely uses simple ASCII or binary serialization without any cryptographic wrapper.

Vulnerable vs. Patched Code

Vulnerable Firmware: R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h

Patched Firmware: None available. The vendor has not released any update.

Code Comparison (Hypothetical):

Vulnerable (no encryption):

void send_location(float lat, float lon) {
    char buffer[256];
    sprintf(buffer, "LAT:%f LON:%f", lat, lon);
    send(sock, buffer, strlen(buffer), 0);
}

Patched (with TLS):

void send_location(float lat, float lon) {
    char buffer[256];
    sprintf(buffer, "LAT:%f LON:%f", lat, lon);
    SSL_write(ssl, buffer, strlen(buffer));
}

Since no patch exists, the only mitigation is network segmentation or decommissioning the device.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Kali Linux machine with tcpdump and Wireshark.
• A Forever KidsWatch KW-50 on the same network.
• Network interface in monitor mode (optional, but helpful).

Step-by-Step Exploitation:

1. Identify the watch’s IP:

   sudo nmap -sn 192.168.1.0/24 | grep -i "watch\|forever"
   

2. Start packet capture:

   sudo tcpdump -i eth0 host <WATCH_IP> -w capture.pcap
   

3. Trigger data transmission (e.g., send a command from the parent app, or wait for periodic location updates).

4. Analyze the capture:

   tshark -r capture.pcap -Y "data" -T fields -e data.text
   

5. Extract cleartext data:

   • Look for strings like LAT:, LON:, CALL:, SMS:.
   • Example output: LAT:40.7128 LON:-74.0060

No public exploit code exists; this is a passive sniffing attack.

Blue Team (Defense)

Detection:

• Monitor for unusual traffic patterns from IoT devices (e.g., large amounts of plaintext data).
• Use the YARA/Sigma rules below.

Mitigation:

• Isolate the watch on a separate VLAN with no internet access.
• Use a VPN or proxy that enforces encryption (though the watch may not support it).
• Replace the device with a secure alternative.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Unencrypted TCP/UDP packets containing patterns like LAT:, LON:, CALL:, SMS:.
  • Traffic to known Forever backend IPs (e.g., 203.0.113.0/24 – placeholder; actual IPs vary).
• Firmware Hash:
  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (example – verify with actual firmware).
• Device Behavior:
  • Periodic location updates every 30–60 seconds.
  • Voice call data sent in cleartext.

Detection Engineering

YARA Rule

rule CVE_2024_36558_KidsWatch_Cleartext {
    meta:
        description = "Detects cleartext transmission of sensitive data from Forever KidsWatch KW-50"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36558"
    strings:
        $lat = "LAT:" ascii wide
        $lon = "LON:" ascii wide
        $call = "CALL:" ascii wide
        $sms = "SMS:" ascii wide
        $auth = "TOKEN:" ascii wide
    condition:
        any of ($lat, $lon, $call, $sms, $auth)
}

Sigma Rule

title: Forever KidsWatch Cleartext Data Transmission
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unencrypted sensitive data from Forever KidsWatch KW-50
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        - payload|contains: "LAT:"
        - payload|contains: "LON:"
        - payload|contains: "CALL:"
        - payload|contains: "SMS:"
        - payload|contains: "TOKEN:"
    condition: selection
falsepositives:
    - Other devices using similar plaintext protocols (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-36558 Forever KidsWatch Cleartext Data"; content:"LAT:"; content:"LON:"; distance:0; within:100; sid:1000001; rev:1;)
alert tcp any any -> any any (msg:"CVE-2024-36558 Forever KidsWatch Call Data"; content:"CALL:"; sid:1000002; rev:1;)
alert tcp any any -> any any (msg:"CVE-2024-36558 Forever KidsWatch SMS Data"; content:"SMS:"; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the watch on a separate VLAN with no access to the internet or other sensitive networks.
2. Firewall Rules: Block all outbound traffic from the watch except to a controlled proxy (if possible).
3. Monitor Traffic: Use the provided detection rules to identify any cleartext data leaks.

Long-Term:

• Replace the device: Since no patch is available, the only secure option is to replace the watch with a model that supports encrypted communications (e.g., TLS 1.2+).
• Vendor Notification: Attempt to contact Forever for a firmware update; if unresponsive, consider reporting to consumer protection agencies.

No patch is available from the vendor.

Valters IT