Security vulnerabilities in children's smartwatches

Security researchers have identified critical vulnerabilities in children’s smartwatches that compromise user privacy and safety.

At the Black Hat conference, researchers demonstrated that inexpensive GPS-enabled watches from brands like CJC, manufactured by YiQingTeng Electronics, lack basic authentication. These flaws allow attackers to hijack devices to track locations, capture photos, record audio, and spoof messages. The study indicated that tens of millions of units across various brands rely on shared supply-chain platforms with similar weaknesses.

In a separate finding, researchers from TU Darmstadt identified vulnerabilities in Xplora smartwatches, a major brand in the European market. The study revealed that extracting a single digital key could grant unauthorized access to private conversations, images, and voice messages. Attackers could also manipulate GPS data to provide false location information. While Xplora has issued security updates, experts continue to advise parents to install all software updates and limit contact lists.