An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle attacks. Furthermore, this lack of authentication allows attackers to interact with the device via BLE without requiring prior authorization.
The device declares no capability for data input and output (no keyboard or screen), so the Bluetooth Low Energy (BLE) pairing mechanism automatically selects the 'Just Works' method. This method does not implement any authentication of the pairing parties, meaning that any attacker within radio range can pair with the device or intercede in communication without the user's knowledge. The lack of authentication also enables direct interaction with the device via BLE without prior authorization.
An attacker can intercept and modify BLE communication between the smartwatch and mobile application (man-in-the-middle attack), and also issue unauthorized commands directly to the device, which threatens the confidentiality, integrity, and availability of data and watch functions.
The COROS PACE 3 device firmware should be updated to a version released after 3.0808.0 in accordance with information in the manufacturer's release notes available at support.coros.com. It is also recommended to avoid pairing the device in public places until the patch is applied.
COROS PACE 3 devices with firmware versions up to and including 3.0808.0 (Yftech Coros Pace 3 Firmware)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HYftech Coros Pace 3
HWYftechwszystkie wersjeYftech Coros Pace 3 Firmware
OSYftech≤ 3.0808.0
Related vulnerabilities
Brak walidacji certyfikatu TLS w COROS PACE 3 — atak MITM
COROS PACE 3 — pobieranie firmware przez niezaszyfrowane HTTP (MitM)
Out-of-bounds read w COROS PACE 3 umożliwia zdalne wymuszenie restartu urządzenia
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connec...
An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sen...