CVE-2025-32876

Katalog CVE

CVSS 6.8 · Medium EPSS 0,40%

Kerentanan Missing Authentication for Critical Function pada yftech coros pace 3 firmware. Skor CVSS 3.1 6.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key (STK) can be easily guessed. This requires knowledge of the Temporary Key (TK), which, in the case of the COROS Pace 3, is set to 0 due to the Just Works pairing method. An attacker within Bluetooth range can therefore perform sniffing attacks, allowing eavesdropping on the communication.

Rincian

Terbit di NVD

20 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://syss.de advisory pihak ketiga
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt exploit · advisory pihak ketiga
• https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes release notes