COROS PACE 3 Bluetooth Pairing Authentication Bypass (CVE-2025-32877)

Key Vulnerability Information Advisory ID: SYSS-2025-024 Product: COROS PACE 3 Manufacturer: COROS Wearables, Inc. Affected Versions: V 3.0008.0 Vulnerability Type: Improper Authentication (CWE-287) Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2025-03-14 Solution Date: 2025-06-17 Public Disclosure: 2025-06-17 CVE Reference: CVE-2025-32877 Overview COROS PACE 3 is a professional GPS sports smartwatch. Due to the use of the "Just Works" pairing method, Bluetooth communication is vulnerable to man-in-the-middle attacks. Vulnerability Details COROS PACE 3 identifies itself without input or output capabilities, resulting in the use of the "Just Works" pairing method, which does not implement any authentication, thus allowing man-in-the-middle attacks. Proof of Concept (PoC) By establishing a connection with the COROS PACE 3 and initiating the pairing process, while analyzing Bluetooth communication, the following behavior can be observed: Tools such as Wireshark can capture SMP pairing requests and responses. Tools and frameworks such as MIRAGE or WHAD can easily exploit this vulnerability. Solution Not yet fixed. Disclosure Timeline 2025-03-18: Vulnerability reported to the manufacturer 2025-03-14: Confirmation received from the manufacturer 2025-03-17: Request for update from the manufacturer 2025-04-07: Follow-up request for update from the manufacturer 2025-04-14: Informed the manufacturer of the assigned CVE ID and solution status 2025-04-15: Received response from the manufacturer, planning to fix the vulnerability by the end of 2025 2025-05-15: Clarified the issue again and recommended prompt resolution 2025-06-17: Public disclosure References [1] COROS PACE 3 product website: https://eu.coros.com/pace3/ [2] SySS security advisory SYSS-2025-024: https://www.sys.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-024.txt [3] SySS responsible disclosure policy: https://www.sys.de/en/responsible-disclosure-policy [4] MIRAGE GitHub repository: https://github.com/Kyame/mirage [5] WHAD GitHub repository: https://github.com/whad-team/whad-client [6] CVE-2025-32877: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32877 [7] Detailed blog post: https://blog.sys.com/posts/bluetooth-analysis-coros-pace-3/ Credits This security vulnerability was discovered by Moritz Abrell of SySS GmbH.

Goal Reached Thanks to every supporter — we hit 100%!

COROS PACE 3 Bluetooth Pairing Authentication Bypass (CVE-2025-32877)