CVE-2025-32880
📋 TL;DR
COROS PACE 3 smartwatches download firmware updates over unencrypted HTTP connections, allowing attackers on the same WLAN network to intercept and potentially modify firmware files. This affects all COROS PACE 3 users with firmware up to version 3.0808.0 who connect their devices to Wi-Fi networks.
💻 Affected Systems
- COROS PACE 3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deliver malicious firmware that compromises the device completely, enabling data theft, device control, or physical harm through incorrect biometric readings.
Likely Case
Attackers intercept firmware updates to analyze device behavior, steal personal data, or deliver modified firmware that appears legitimate but contains backdoors.
If Mitigated
With proper network segmentation and monitoring, attackers would be limited to sniffing unencrypted traffic without being able to deliver malicious payloads.
🎯 Exploit Status
Exploitation requires attacker to be on same WLAN network as the device during firmware update process. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check COROS support for latest firmware
Vendor Advisory: https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes
Restart Required: Yes
Instructions:
1. Open COROS app on paired smartphone. 2. Navigate to Device Settings > Firmware Update. 3. Install latest available firmware. 4. Restart watch after update completes.
🔧 Temporary Workarounds
Disable Wi-Fi firmware updates
allPrevent device from downloading firmware over Wi-Fi by disabling Wi-Fi connectivity
Settings > Connectivity > Wi-Fi > Off
Use trusted networks only
allOnly connect device to secure, trusted Wi-Fi networks with strong encryption
🧯 If You Can't Patch
- Never connect device to public or untrusted Wi-Fi networks
- Monitor network traffic for HTTP firmware download attempts and block them at firewall
🔍 How to Verify
Check if Vulnerable:
Check firmware version in COROS app: Device Settings > About > Firmware Version. If version is 3.0808.0 or earlier, device is vulnerable.Check Version:
COROS app: Device Settings > About > Firmware VersionVerify Fix Applied:
After updating, verify firmware version is newer than 3.0808.0 and check that firmware downloads now use HTTPS instead of HTTP.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to firmware download servers
- Unusual firmware update activity
Network Indicators:
- HTTP traffic to COROS firmware servers on port 80
- Firmware file downloads without TLS encryption
SIEM Query:
destination_port:80 AND (http.host:*.coros.com OR http.uri:*firmware*)