CVE-2025-32879
📋 TL;DR
COROS PACE 3 fitness watches through version 3.0808.0 automatically advertise via Bluetooth Low Energy when not connected to a paired device, allowing any nearby attacker to connect without authentication. Once connected, all BLE services and characteristics are accessible, enabling device configuration, notifications, factory resets, or software installation. This affects all COROS PACE 3 users who haven't updated their device firmware.
💻 Affected Systems
- COROS PACE 3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could install malicious firmware, permanently compromise the device, steal personal fitness/health data, or brick the device via factory reset.
Likely Case
Nearby attackers could connect to unattended devices, send fake notifications, change device settings, or reset the device to factory defaults.
If Mitigated
With proper Bluetooth security controls and device pairing, the attack surface is significantly reduced to only physical proximity threats.
🎯 Exploit Status
Exploitation requires only standard Bluetooth tools (like gatttool, nRF Connect) and physical proximity. The SYSS advisory includes technical details of vulnerable services/characteristics.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.0808.0
Vendor Advisory: https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes
Restart Required: Yes
Instructions:
1. Open COROS app on paired smartphone. 2. Navigate to Device Settings > System Updates. 3. Check for and install available firmware updates. 4. Ensure update completes and device restarts. 5. Verify firmware version is above 3.0808.0.
🔧 Temporary Workarounds
Maintain Active Bluetooth Connection
allKeep device constantly connected to paired smartphone via COROS app to prevent vulnerable advertising state.
Disable Bluetooth When Not in Use
allTurn off Bluetooth on the PACE 3 device when not actively syncing or using connected features.
🧯 If You Can't Patch
- Never leave device unattended in public spaces where Bluetooth range attackers could be present.
- Ensure device is always paired and connected to your smartphone when in use to prevent vulnerable advertising state.
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in COROS app: Device Settings > About Device. If version is 3.0808.0 or lower, device is vulnerable.Check Version:
No CLI command - check via COROS mobile app: Device Settings > About DeviceVerify Fix Applied:
Confirm firmware version is above 3.0808.0 in COROS app. Test with Bluetooth scanner: device should not advertise when not connected to paired device.📡 Detection & Monitoring
Log Indicators:
- Unexpected Bluetooth connections in device logs
- Unauthorized configuration changes
Network Indicators:
- Unexpected BLE connections to PACE 3 devices
- Bluetooth scanning detecting vulnerable advertising behavior
SIEM Query:
Not applicable - this is a physical proximity Bluetooth attack not typically logged in enterprise SIEM systems.