CVE-2025-32880

Executive Summary

CVE-2025-32880 exposes a critical security flaw in the COROS PACE 3 smartwatch (firmware versions through 3.0808.0). The device downloads firmware updates over unencrypted HTTP, allowing any attacker with WLAN access to intercept, sniff, or perform machine-in-the-middle (MITM) attacks. This can lead to the injection of malicious firmware, data exfiltration, or persistent compromise of the device. The vulnerability is unpatched and has no public exploit code, but the attack vector is straightforward and requires only network proximity.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a consumer IoT device.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Adjacent Network (WLAN)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Threat Level: Critical. The attack is easy to execute (MITM on WLAN) and can lead to full device compromise.

Deep Dive & Mechanics

The COROS PACE 3 implements a WLAN connection function to download firmware updates. The update process uses plain HTTP (port 80) without any encryption or integrity checks. This allows an attacker on the same WLAN to:

1. Sniff traffic: Capture firmware files and any other data transmitted over HTTP.
2. Perform MITM: Intercept the firmware download request and serve a malicious firmware file.
3. Inject arbitrary code: Replace the legitimate firmware with a backdoored version, gaining persistent control over the watch.

The vulnerability is rooted in the lack of TLS/SSL for firmware updates. The device does not validate the server certificate or use any cryptographic signing for the firmware file.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// HTTP download without encryption
void download_firmware(char *url) {
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    connect(sock, server, 80);
    send(sock, "GET /firmware.bin HTTP/1.1\r\nHost: updates.coros.com\r\n\r\n");
    recv(sock, firmware_data, ...);
    flash_firmware(firmware_data);
}

Patched Code (Conceptual):

// HTTPS download with certificate validation
void download_firmware(char *url) {
    SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
    SSL *ssl = SSL_new(ctx);
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    connect(sock, server, 443);
    SSL_set_fd(ssl, sock);
    SSL_connect(ssl);
    SSL_write(ssl, "GET /firmware.bin HTTP/1.1\r\nHost: updates.coros.com\r\n\r\n");
    SSL_read(ssl, firmware_data, ...);
    // Verify firmware signature
    if (verify_signature(firmware_data)) {
        flash_firmware(firmware_data);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• COROS PACE 3 with firmware <= 3.0808.0
• Attacker machine on the same WLAN (e.g., Kali Linux)
• MITM tool (e.g., Bettercap, mitmproxy, or custom ARP spoofing)

Steps:

1. ARP Spoofing: Poison the ARP cache of the watch and the legitimate update server.

   sudo bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on"
   

2. DNS Spoofing: Redirect updates.coros.com to your attacker IP.

   sudo bettercap -eval "set dns.spoof.domains updates.coros.com; dns.spoof on"
   

3. Serve Malicious Firmware: Host a modified firmware file on your machine.

   python3 -m http.server 80
   

4. Trigger Update: Wait for the watch to check for updates or manually initiate an update.
5. Gain Control: The watch will download and flash the malicious firmware, giving you persistent access.

Blue Team

Detection:

• Monitor for ARP spoofing attacks on the WLAN.
• Use network monitoring tools (e.g., Wireshark) to detect unencrypted HTTP traffic to firmware update endpoints.
• Check for unexpected DNS responses for updates.coros.com.

Mitigation:

• Isolate IoT devices on a separate VLAN with strict firewall rules.
• Disable automatic firmware updates until a patch is available.
• Use a VPN or proxy to enforce HTTPS for all outbound traffic from the watch.

Indicators of Compromise (IOCs)

• Network:
  • Unencrypted HTTP traffic to updates.coros.com (port 80)
  • ARP spoofing packets (unusual MAC-to-IP mappings)
  • DNS responses pointing to non-standard IPs for updates.coros.com
• File:
  • Firmware files downloaded over HTTP (e.g., firmware.bin)
  • Modified firmware with unexpected code or signatures
• Behavior:
  • Watch performing unexpected reboots or behavior changes after an update
  • Unusual network connections from the watch to unknown IPs

Detection Engineering

YARA Rule

rule COROS_HTTP_Firmware_Download {
    meta:
        description = "Detects unencrypted HTTP firmware download by COROS PACE 3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32880"
    strings:
        $http_get = "GET /firmware" ascii
        $host = "updates.coros.com" ascii
        $http_response = "HTTP/1.1 200 OK" ascii
    condition:
        $http_get and $host and $http_response
}

Sigma Rule

title: COROS PACE 3 Unencrypted Firmware Download
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP traffic to COROS firmware update server
author: Valters IT
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 80
        DestinationHostname: 'updates.coros.com'
        Image: '*'
    condition: selection
falsepositives:
    - Legitimate firmware updates (if any)
level: high

Suricata Rule

alert http any any -> any 80 (msg:"COROS PACE 3 Unencrypted Firmware Download"; flow:to_server; content:"GET"; http_method; content:"/firmware"; http_uri; content:"Host: updates.coros.com"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable automatic firmware updates on the COROS PACE 3 until a patch is released.
2. Use a separate, isolated WLAN for IoT devices to limit exposure.
3. Monitor network traffic for any unencrypted HTTP connections to updates.coros.com.

Long-Term Fix:

• COROS must implement HTTPS with certificate pinning for all firmware downloads.
• Firmware files should be cryptographically signed and verified before flashing.
• Users should update to a patched firmware version once available.

Workaround:

• If possible, block outbound HTTP traffic from the watch at the network level (firewall rule: deny port 80 to updates.coros.com).

Valters IT
DevSecOps & Cyber Threat Intelligence