CVE-2019-20470

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-01 · updated 2026-06-17
Weakness: CWE-1188

Description

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up a voice communication channel from the watch to any telephone number, initiated by sending a specific SMS and using the default password, e.g., pw,<password>,call,<mobile_number> triggers an outbound call from the watch. The password is sometimes available because of CVE-2019-20471.

Affected products

Tk-Star Q90 Junior Gps Horloge Firmware: 3.1042.9.8656

References

http://seclists.org/fulldisclosure/2024/Jul/14
https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/
https://www.tk-star.com
http://seclists.org/fulldisclosure/2024/Jul/14
https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/
https://www.tk-star.com

Get alerted when CVE-2019-20470 or the next vulnerability affects your stack