Kidde Smart Smoke & CO Alarm (KD2K-SM2)

Kidde Smart Smoke & CO Alarm (KD2K-SM2)
Security Grade F Calculator v	Kidde Smart Smoke & CO Alarm Brand: Kidde (Parent: Carrier Global Corporation) Category: Sensor • Model / Gen: KD2K-SM2 Release Date: 2022-03-08 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—
Known vulnerabilities	Very common	🔗 Proof
Prior attacks	Rare	🔗 Proof
Updatability	None	—
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—
Communications	Encrypted with obselete encryption	—
Storage	No encryption	—
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—
Authentication	Basic	🔗 Proof
Brute-force protection	Absent	—
Event logging	Partial logging	—
Passwords	Default/Common/Easy to guess	—
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	RTOS (Companion App: )
Hardware (CPU / GPU)	CPU: ARM Cortex-M4 • GPU: None
Memory & Storage	Memory: 64 KB RAM • Storage: 512 KB Flash
Power, Battery & Charging	Battery: AA batteries x 3 • Power: Battery powered • Charging:
Display & Camera	Display: LED status light • Camera: None
Sound & Connectivity	Sound: • Connectivity: 2.4GHz Wi-Fi, Z-Wave
Physical (Dimensions & Mass)	Dimensions: None • Mass: None

CVE-2024-23738 is a command injection flaw in the Kidde Smart smoke and carbon monoxide alarms (CVSS 9.8, Critical). An attacker on the local network can send a crafted command to the device, which causes a denial-of-service condition and may allow code execution. If the alarm is disabled by an attacker, it no longer warns the residents about smoke or carbon monoxide, which creates a direct physical safety risk. The device receives firmware updates rarely, so the exposure lasts a long time.