CVE-2025-32879

Katalog CVE

CVSS 8.8 · High EPSS 0,53%

Kerentanan Improper Authentication pada yftech coros pace 3 firmware. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device require any authentication or security level. Therefore, any characteristic, depending on their mode of operation (read/write/notify), can be used by the connected attacker. This allows, for example, configuring the device, sending notifications, resetting the device to factory settings, or installing software.

Rincian

Terbit di NVD

20 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://syss.de advisory pihak ketiga
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-026.txt exploit · advisory pihak ketiga
• https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes release notes