PT-2025-26313 · Coros · Coros Pace 3

Moritz Abrell · Published 2025-06-20 · Updated 2025-07-08 · CVE-2025-32876

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 devices versions through 3.0808.0

Description: An issue was discovered in the BLE implementation of the COROS smartwatch, which does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In this pairing method, the Short-Term Key (STK) can be easily guessed, requiring knowledge of the Temporary Key (TK), which is set to 0 due to the Just Works pairing method. This allows an attacker within Bluetooth range to perform sniffing attacks, enabling eavesdropping on the communication.

Recommendations: For COROS PACE 3 devices versions through 3.0808.0, consider disabling Bluetooth functionality until a patch is available to mitigate the risk of sniffing attacks. Restrict access to sensitive information on the device to minimize the risk of eavesdropping. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-32876

Affected Products

Coros Pace 3

References · 8

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32876 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32876 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1936095503743156712 · Twitter Post
• https://twitter.com/CVEnew/status/1936508732546134153 · Twitter Post
• https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes · Note
• https://syss.de · Note
• https://t.me/cvenotify/127987 · Telegram Post