CVE-2025-32876

Executive Summary

CVE-2025-32876 exposes a critical security flaw in the COROS PACE 3 smartwatch, specifically within its Bluetooth Low Energy (BLE) implementation. The device enforces BLE Legacy Pairing with the "Just Works" method, which sets the Temporary Key (TK) to zero. This allows an attacker within Bluetooth range to easily guess the Short-Term Key (STK) and perform sniffing attacks, leading to the eavesdropping of all unencrypted BLE communication between the watch and its paired device (e.g., a smartphone). The vulnerability has a CVSS score of 0.0 (likely a placeholder), but the actual risk is significant for user privacy and data confidentiality. No official patch has been released by COROS as of the latest firmware version 3.0808.0.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware-level issue in the COROS PACE 3 smartwatch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) - The attacker must be within Bluetooth range (typically up to 10-100 meters).
• Attack Complexity (AC): Low (AC:L) - The attack requires no special conditions; the TK is always zero.
• Privileges Required (PR): None (PR:N) - No authentication is needed.
• User Interaction (UI): None (UI:N) - The attack can be performed without user interaction.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) - All BLE communication can be eavesdropped.
• Integrity (I): None (I:N) - The attack does not allow modification of data.
• Availability (A): None (A:N) - The attack does not affect availability.

Threat Level: High. The attack is trivial to execute with off-the-shelf hardware (e.g., a Bluetooth dongle and Wireshark). The impact on user privacy is severe, as all data transmitted over BLE (e.g., health metrics, workout data, notifications) can be intercepted.

Deep Dive & Mechanics

The COROS PACE 3 uses BLE Legacy Pairing with the "Just Works" association model. In BLE Legacy Pairing, the pairing process involves the following steps:

1. TK Generation: The Temporary Key (TK) is generated. For "Just Works," the TK is always set to 0.
2. STK Generation: The Short-Term Key (STK) is derived from the TK using a simple function: STK = s1(TK, SConfirm, MConfirm) where s1 is a basic cryptographic function.
3. Encryption: The STK is used to encrypt the link.

Because the TK is fixed at 0, the STK is deterministic and can be computed by an attacker who captures the pairing packets (SConfirm and MConfirm). Once the STK is known, the attacker can decrypt all subsequent BLE traffic.

The attack flow:

1. Attacker places a BLE sniffer (e.g., nRF52840 Dongle with Wireshark) within range of the COROS PACE 3 and its paired smartphone.
2. The attacker captures the pairing process (or forces a re-pairing by jamming the connection).
3. The attacker extracts the SConfirm and MConfirm values from the captured packets.
4. The attacker computes the STK using the known TK (0).
5. The attacker uses the STK to decrypt all subsequent BLE data packets.

Vulnerable vs. Patched Code

Vulnerable Code (COROS PACE 3 firmware <= 3.0808.0): The BLE stack is configured to use Legacy Pairing with "Just Works." This is typically set in the BLE initialization code.

// Vulnerable BLE configuration (pseudocode)
ble_gap_sec_params_t sec_params;
sec_params.bond = 1;
sec_params.mitm = 0; // No MITM protection
sec_params.lesc = 0; // LE Secure Connections disabled
sec_params.keypress = 0;
sec_params.io_caps = BLE_GAP_IO_CAPS_NONE; // Just Works
sec_params.oob = 0;
sec_params.min_key_size = 7;
sec_params.max_key_size = 16;

Patched Code (Hypothetical fix): The fix would involve enabling LE Secure Connections (LESC) and using a proper IO capability (e.g., display Yes/No) to generate a non-zero TK.

// Patched BLE configuration (pseudocode)
ble_gap_sec_params_t sec_params;
sec_params.bond = 1;
sec_params.mitm = 1; // Enable MITM protection
sec_params.lesc = 1; // Enable LE Secure Connections
sec_params.keypress = 0;
sec_params.io_caps = BLE_GAP_IO_CAPS_DISPLAY_YESNO; // Use display for TK
sec_params.oob = 0;
sec_params.min_key_size = 16;
sec_params.max_key_size = 16;

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Hardware: nRF52840 Dongle (or any BLE sniffer supporting BLE 4.2/5.0), COROS PACE 3 smartwatch, paired smartphone.
2. Software: Wireshark with BLE plugin, Python with bleak library, btlejack (optional).

Exploitation Steps:

1. Capture Pairing Process:

   • Use Wireshark to capture BLE packets. Filter for btle and look for LL_CONNECTION_IND and LL_PAIRING_REQ.
   • Alternatively, use btlejack to force a re-pairing by sending a disconnection packet.

2. Extract SConfirm and MConfirm:

   • From the captured pairing packets, extract the SConfirm (Slave Confirm) and MConfirm (Master Confirm) values. These are 16-byte values.

3. Compute STK:

   • Use the following Python script to compute the STK:

import hashlib

def s1(tk, sconfirm, mconfirm):
    # BLE Legacy Pairing STK generation
    # STK = s1(TK, SConfirm, MConfirm)
    # s1 is a simple XOR-based function
    stk = bytearray(16)
    for i in range(16):
        stk[i] = tk[i] ^ sconfirm[i] ^ mconfirm[i]
    return bytes(stk)

# Example values (replace with captured ones)
tk = bytes([0]*16)  # TK is zero for Just Works
sconfirm = bytes.fromhex("AABBCCDDEEFF00112233445566778899")
mconfirm = bytes.fromhex("99887766554433221100FFEEDDCCBBAA")

stk = s1(tk, sconfirm, mconfirm)
print(f"STK: {stk.hex()}")

4. Decrypt BLE Traffic:
   • In Wireshark, go to Edit -> Preferences -> Protocols -> BTLE and set the LTK (Long Term Key) to the computed STK.
   • Wireshark will now decrypt all subsequent BLE data packets.

Blue Team (Defensive)

Detection:

1. Monitor for BLE Re-pairing Events: Log all BLE pairing events on the smartphone. Unexpected re-pairing requests may indicate an attack.
2. Traffic Analysis: Use a BLE sniffer to monitor for unusual patterns, such as repeated pairing requests or disconnections.
3. Firmware Integrity: Ensure the COROS PACE 3 firmware is up-to-date. Check for any security patches from COROS.

Mitigation:

1. Disable BLE When Not in Use: Turn off Bluetooth on the smartphone when not actively syncing with the watch.
2. Use a Faraday Cage: For high-security environments, store the watch in a Faraday bag when not in use.
3. Vendor Patch: Await a firmware update from COROS that enables LE Secure Connections.

Indicators of Compromise (IOCs)

• Network IOCs:
  • BLE packets with LL_PAIRING_REQ and LL_PAIRING_RSP where the IO Capabilities field is set to NoInputNoOutput (0x03).
  • BLE packets with LL_ENC_REQ and LL_ENC_RSP where the LTK is derived from a zero TK.
• Host IOCs:
  • Unexpected BLE re-pairing notifications on the paired smartphone.
  • Unusual BLE disconnection events followed by immediate reconnection.
• File IOCs:
  • Captured BLE pcap files containing pairing packets with IO Capabilities: NoInputNoOutput.

Detection Engineering

YARA Rule

rule CVE_2025_32876_BLE_Legacy_Pairing {
    meta:
        description = "Detects BLE Legacy Pairing with Just Works (TK=0) in pcap files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32876"
    strings:
        $pairing_req = { 01 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } // LL_PAIRING_REQ with IO Capabilities = NoInputNoOutput
        $pairing_rsp = { 02 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } // LL_PAIRING_RSP with IO Capabilities = NoInputNoOutput
    condition:
        $pairing_req or $pairing_rsp
}

Sigma Rule

title: BLE Legacy Pairing with Just Works (CVE-2025-32876)
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects BLE pairing packets indicating Legacy Pairing with Just Works method
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32876
logsource:
    category: network
    product: wireshark
    service: btle
detection:
    selection:
        btle.pairing.io_capabilities: "NoInputNoOutput"
        btle.pairing.lesc: "0"
    condition: selection
falsepositives:
    - Legitimate COROS PACE 3 devices
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-32876 BLE Legacy Pairing Detected"; content:"|01 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Bluetooth on the smartphone when not actively syncing with the COROS PACE 3.
2. Use a Faraday cage for the watch when not in use to prevent any BLE communication.
3. Monitor for firmware updates from COROS. The fix should enable LE Secure Connections (LESC) and use a proper IO capability (e.g., display Yes/No) to generate a non-zero TK.

Long-term Fix:

• COROS must release a firmware update that:
  • Enables LE Secure Connections (LESC) with Elliptic Curve Diffie-Hellman (ECDH) key exchange.
  • Uses a proper IO capability (e.g., DisplayYesNo) to generate a non-zero TK.
  • Implements MITM protection.

Workaround:

• Users can pair the watch using an out-of-band (OOB) method if supported, but this is not available in the current firmware.

Valters IT
Securing the future, one vulnerability at a time.