CVE-2025-48706

An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot...

CVE-2025-32877

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle...

CVE-2025-32876

An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key STK can be easily guessed. This requires knowledge of the...

COROS PACE 3 安全漏洞

COROS PACE 3 is a GPS sports watch from COROS China. A security vulnerability exists in COROS PACE 3 3.0808.0 and prior versions, which stems from a BLE implementation that only supports older pairings and could lead to communication eavesdropping...

PT-2025-26317 · Coros · Coros Pace 3

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An out-of-bounds read vulnerability exists in COROS PACE 3. Sending a crafted Bluetooth Low Energy BLE message forces the device to reboot. Recommendations: Update COROS PACE 3 to a version...

CVE-2025-48706

An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot...

CVE-2025-32877

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle...

CVE-2025-32877

CVE-2025-32877 affects COROS PACE 3 devices up to firmware 3.0808.0. The device identifies itself as having no input/output capabilities, leading to the use of the Just Works BLE pairing method with no authentication. This enables a machine-in-the-middle scenario and allows attackers to interact ...

CVE-2025-32879

CVE-2025-32879 affects COROS PACE 3 (up to v3.0808.0). The device advertises when no Bluetooth connection is present, allowing an unauthenticated BLE connection. Once connected, all BLE services/characteristics appear to require no authentication, enabling actions such as configuring the device, ...

Code Injection Vulnerabilities in Various ABB Products (CNVD-2025-13765)

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

Vulnerabilities in Code Issues in Various ABB Products (CNVD-2025-13598)

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

Various ABB products code issues vulnerabilities

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: PM: EM: Fixed a potential division-by-zero error in emcomputecosts. When the device is of a non-CPU type, tablei.performance will not be initialized in the previous eminitperformance call. This results in a division by zero when...

Astra Linux – Vulnerability in Intel Microcode

Observable discrepancies in the RAPL interface of certain Intel processors may allow a privileged user to potentially enable information disclosure through local access...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

CVE-2025-5872

A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed t...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...

CVE-2025-40585

Summary: CVE-2025-40585 affects Siemens Energy Services for all versions using the G5DFR component, where default credentials enable an attacker to gain control of G5DFR and tamper with device outputs. What’s affected: Energy Services with G5DFR (default credentials exist). Cause: Use of default ...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...