CVE-2025-32876
📋 TL;DR
This vulnerability allows attackers within Bluetooth range to eavesdrop on communications between COROS PACE 3 smartwatches and paired devices. The BLE implementation uses insecure legacy pairing with a predictable encryption key, enabling sniffing attacks. Only COROS PACE 3 smartwatch users are affected.
💻 Affected Systems
- COROS PACE 3 smartwatch
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete interception of all Bluetooth communication including sensitive health data, location information, and device control commands.
Likely Case
Passive eavesdropping on transmitted data such as fitness metrics, notifications, and basic device communications.
If Mitigated
Limited data exposure if Bluetooth is disabled or device is kept away from potential attackers.
🎯 Exploit Status
Attack requires specialized Bluetooth sniffing hardware and proximity to target device. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.0808.0
Vendor Advisory: https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes
Restart Required: Yes
Instructions:
1. Open COROS app on paired smartphone. 2. Navigate to device settings. 3. Check for firmware updates. 4. Install available update. 5. Restart the PACE 3 device after update completes.
🔧 Temporary Workarounds
Disable Bluetooth when not needed
allTurn off Bluetooth connectivity to prevent any pairing or communication attacks
On device: Settings > Connectivity > Bluetooth > Toggle Off
Limit Bluetooth pairing
allUnpair unnecessary devices and avoid new pairings in public spaces
On device: Settings > Connectivity > Bluetooth > Paired Devices > Remove unwanted devices
🧯 If You Can't Patch
- Keep device in airplane mode when not actively syncing data
- Avoid using Bluetooth in crowded public areas where attackers may be present
🔍 How to Verify
Check if Vulnerable:
Check firmware version on device: Settings > System > About > Firmware Version. If version is 3.0808.0 or earlier, device is vulnerable.Check Version:
On device: Settings > System > About > Firmware VersionVerify Fix Applied:
Verify firmware version is higher than 3.0808.0. Test Bluetooth pairing to confirm LE Secure Connections is being used (requires specialized tools).📡 Detection & Monitoring
Log Indicators:
- Unusual Bluetooth pairing attempts
- Multiple failed pairing requests from unknown devices
Network Indicators:
- Bluetooth traffic patterns indicating legacy pairing
- BLE packets with TK=0 in pairing process
SIEM Query:
Not applicable - this is a Bluetooth/local attack not typically logged in enterprise SIEM systems.