CVE-2025-32876

An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key (STK) can be easily guessed. This requires knowledge of the Temporary Key (TK), which, in the case of the COROS Pace 3, is set to 0 due to the Just Works pairing method. An attacker within Bluetooth range can therefore perform sniffing attacks, allowing eavesdropping on the communication.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes	Release Notes
https://syss.de	Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt	Exploit Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:yftech:coros_pace_3_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:yftech:coros_pace_3:-:*:*:*:*:*:*:*

History

08 Jul 2025, 14:32

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-20 14:15

Updated : 2025-07-08 14:32

NVD link : CVE-2025-32876

Mitre link : CVE-2025-32876

CVE.ORG link : CVE-2025-32876

JSON object : View

Products Affected

yftech

coros_pace_3
coros_pace_3_firmware

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-32876", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2025-06-20T14:15:27.877", "references": [{"url": "https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://syss.de", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key (STK) can be easily guessed. This requires knowledge of the Temporary Key (TK), which, in the case of the COROS Pace 3, is set to 0 due to the Just Works pairing method. An attacker within Bluetooth range can therefore perform sniffing attacks, allowing eavesdropping on the communication."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos COROS PACE 3 hasta la versi\u00f3n 3.0808.0. La implementaci\u00f3n BLE del reloj inteligente COROS no es compatible con las conexiones seguras LE y, en su lugar, aplica el emparejamiento heredado BLE. En el emparejamiento heredado BLE, la clave de corto plazo (STK) se puede adivinar f\u00e1cilmente. Esto requiere conocer la clave temporal (TK), que, en el caso del COROS Pace 3, est\u00e1 configurada a 0 debido al m\u00e9todo de emparejamiento Just Works. Por lo tanto, un atacante dentro del alcance de Bluetooth puede realizar ataques de rastreo, lo que permite interceptar la comunicaci\u00f3n."}], "lastModified": "2025-07-08T14:32:59.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yftech:coros_pace_3_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76182C50-BA03-4620-A65E-532178F36676", "versionEndIncluding": "3.0808.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yftech:coros_pace_3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B4556211-076C-4EC0-A94E-5AB5C2D86DBB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}