CVE-2024-36557: Authentication Bypass by Spoofing

The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me 2 KW60 R36CWYDES4A292V1.02023.05.2422.49.44cobb. If a malicious user changes the IMEI to the IMEI of a unit they registered in the mobile app, it is possible to...

CVE-2024-36553: Channel Accessible by Non-Endpoint

Forever KidsWatch Call Me KW-50 R36YDRA3PWGM7SV1.02019071516.19.24cobh is vulnerable to MITM attack...

CVE-2024-36556: Use of Hard-coded Credentials

Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh, and Forever KidsWatch Call Me 2 KW60 R36CWYDES4A292V1.02023.05.2422.49.44cobb have a Hardcoded password vulnerability...

CVE-2024-36554: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Forever KidsWatch Call Me KW-50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me KW-60 R36CWYDES4A292V1.02023.05.2422.49.44cobb allow a malicious user to gain information about the device by sending an SMS to the device which returns sensitive information...

CVE-2024-36558: Cleartext Transmission of Sensitive Information

Forever KidsWatch Call Me KW-50 R36YDRA3PWGM7SV1.02019071516.19.24cobh suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication...

CVE-2024-36555: Missing Authentication for Critical Function

Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36YDRA3PWGM7SV1.02019071516.19.24cobh and Forever KidsWatch Call Me 2 KW-60 R36CWYDES4A292V1.02023.05.2422.49.44cobb allows malicious users to change the device IMEI-number which allows for forging the identity of the device...