COROS PACE 3 Unencrypted Firmware Download via HTTP (CVE-2025-32880)

Key Vulnerability Information Advisory ID: SYSS-2025-829 Product: COROS PACE 3 Manufacturer: COROS Electronics, Inc. Affected Versions: <= V 3.0000.0 Tested Version(s): V 3.0000.0 Vulnerability Type: Insecure Transmission of Sensitive Information (CWE-319) Risk Level: Medium Resolution Status: Not yet fixed Manufacturer Notification Date: 2025-03-14 Solution Date: N.A. CVE Reference: CVE-2025-32880 Author of Advisory: Moritz Abrell, SySS GmbH Overview COROS PACE 3 is a professional GPS sports smartwatch. Due to the use of unencrypted HTTP when downloading firmware files over WLAN, attackers can eavesdrop on and manipulate transmitted data via a man-in-the-middle attack. Vulnerability Details COROS PACE 3 implements a feature that allows the watch to connect to WLAN. When accessing WLAN, COROS PACE 3 downloads firmware files via HTTP. However, the communication is unencrypted, enabling eavesdropping and man-in-the-middle attacks. Proof of Concept (PoC) Connect the COROS PACE 3 to a WLAN network controlled by the attacker. Subsequently, HTTP communication can be intercepted, for example, using Wireshark. Solution Not yet fixed. Disclosure Timeline 2025-03-10: Vulnerability discovered 2025-03-14: Vulnerability reported to manufacturer 2025-03-16: Confirmation received and request for update 2025-03-31: Additional information provided to manufacturer 2025-04-07: Follow-up inquiry to manufacturer for update 2025-04-14: Follow-up inquiry regarding assigned CVE-ID and request for update 2025-04-15: Manufacturer informed SySS GmbH that there are currently no plans to fix this vulnerability 2025-04-25: Manufacturer reminded again, with emphasis on the issue and recommendation for prompt resolution 2025-06-17: Public disclosure References [1] COROS PACE 3 product website: https://eu.coros.com/pace3/ [2] SySS security advisory SYSS-2025-829: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-829.txt [3] SySS responsible disclosure policy: https://www.syss.de/en/responsible-disclosure-policy [4] CVE ID: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32880 [5] Detailed blog post: https://blog.syss.com/posts/bluetooth-analysis-coros-pace-3/ Credits This security vulnerability was discovered by Moritz Abrell of SySS GmbH.

Goal Reached Thanks to every supporter — we hit 100%!

COROS PACE 3 Unencrypted Firmware Download via HTTP (CVE-2025-32880)