CVE-2024-36555 Missing authorization in n/a
Attackers can modify the device IMEI via an unprotected SMS command, enabling identity forgery on Forever KidsWatch devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-36555?
CVE-2024-36555 is a critical missing authorization vulnerability in n/a, published on 6 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allows malicious users to change the device IMEI-number which allows for forging the identity of the device.
Weakness: CWE-306
Which versions are affected by CVE-2024-36555?
How do I fix CVE-2024-36555?
No fix has been published for CVE-2024-36555 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-36555 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36555 exists.
Sources
Also known as GHSA-r3wg-39gf-vffc.