PT-2025-26314 · Coros · Coros Pace 3

Moritz Abrell · Published 2025-06-20 · Updated 2025-07-08 · CVE-2025-32878

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0

Description: An issue was discovered that allows an attacker to eavesdrop and manipulate HTTPS communication. The device does not validate the X.509 server certificate within the TLS handshake, enabling an attacker in an active machine-in-the-middle position to exploit this using a TLS proxy and a self-signed certificate. This could be abused to steal the API access token of the assigned user account.

Recommendations: For COROS PACE 3 versions through 3.0808.0, as a temporary workaround, consider disabling the WLAN connection function until a patch is available to validate the X.509 server certificate. Restrict access to sensitive information, such as API access tokens, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-32878

Affected Products

Coros Pace 3

References · 8

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-030.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32878 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32878 · Vendor Advisory
• https://twitter.com/CVEnew/status/1936508734257443060 · Twitter Post
• https://t.me/cvenotify/126259 · Telegram Post
• https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes · Note
• https://syss.de · Note
• https://t.me/cvenotify/127989 · Telegram Post