Overview
This blog post delves into the details of a recently discovered vulnerability designated as CVE-2025-32879. This vulnerability affects COROS PACE 3 devices up to and including version 3.0808.0. The essence of this vulnerability is that it allows an attacker unauthenticated access to the device via Bluetooth Low Energy (BLE) and thus potentially compromising the system and leading to data leakage. This vulnerability is particularly concerning due to the lack of any requirement for authentication or security level for any of the BLE services and characteristics of the device while connected.
Vulnerability Summary
CVE ID: CVE-2025-32879
Severity: High (8.8 CVSS v3)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
COROS PACE 3 | Up to 3.0808.0
How the Exploit Works
The exploit takes advantage of an issue in the COROS PACE 3 devices where the device starts advertising itself if no device is connected via Bluetooth. An attacker can exploit this vulnerability by connecting to the device via BLE. Once connected, the attacker can access any of the BLE services and characteristics without any requirement for authentication or security level. This allows the attacker to potentially configure the device, send notifications, reset the device to factory settings, or install software.
Conceptual Example Code
Here’s a conceptual example of how this vulnerability might be exploited, using pseudocode:
# Establish BLE connection
device = BLE.connect('COROS PACE 3')
# Check if connection is established
if device.isConnected():
# Access unauthenticated services
service = device.getService('unauthenticated_service')
# Write to the service
service.write('malicious_payload')
# Read from the service
data = service.read()
# Install software or reset the device
service.install_software('malicious_software')
service.reset_device()Please note that the above code is purely hypothetical and serves only to illustrate the potential exploit. Actual exploitation would require knowledge of the specific BLE services and characteristics exposed by the vulnerable device.