CVE-2025-32879
BaseFortify
Publication date: 2025-06-20
Last updated on: 2025-07-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yftech | coros_pace_3_firmware | to 3.0808.0 (inc) |
| yftech | coros_pace_3 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in COROS PACE 3 devices up to firmware version 3.0808.0 allows an attacker to connect to the device via Bluetooth Low Energy (BLE) when no other device is connected. The device advertises itself openly in this state. Once connected, the attacker can access all BLE services and characteristics without any authentication or security checks. This means the attacker can read or write any data, enabling actions such as configuring the device, sending notifications, resetting it to factory settings, or installing software. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker within Bluetooth range to take full control of your COROS PACE 3 device without your permission. They could change device settings, send unauthorized notifications, reset the device to factory defaults, or install potentially malicious software. This compromises the security and integrity of your device and any data it holds or processes. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by scanning for BLE advertising from COROS PACE 3 devices when no other device is connected. Using standard BLE tools like 'gatttool' or BLE scanning utilities, you can check if the device is advertising and allows connections without authentication. For example, using 'gatttool' to connect and attempt to read or write to BLE characteristics can confirm the vulnerability. Specific commands include writing hex values to characteristic handles to test for unauthorized control, such as factory reset commands or toggling settings. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding leaving the COROS PACE 3 device in a state where it is advertising and unconnected via BLE, as this allows unauthorized connections. Limit physical access to the device to prevent attackers from connecting via BLE. Since no fix is currently available, monitor for firmware updates from the manufacturer expected by the end of 2025 and apply them promptly once released. [1]