20459 matches found
CVE-2025-32876
An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key STK can be easily guessed. This requires knowledge of the...
CVE-2025-32876
An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key STK can be easily guessed. This requires knowledge of the...
CVE-2022-50166
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: When HCI work queue is drained, only queue chained work The HCI command, event, and data packet processing workqueue is drained to avoid deadlock in commit 76727c02c1e1 "Bluetooth: Call drainworkqueue before resetting...
CVE-2025-32875
An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing...
CVE-2025-32876
An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key STK can be easily guessed. This requires knowledge of the...
PT-2025-26321 · Coros · Coros Pace 3
Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that affects the Bluetooth pairing method of the device. It identifies itself as a device without input or output capabilities, resulting in the use of the Just Works...
CVE-2025-32877
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle...
CVE-2025-32875
The COROS application (version 3.8.12 and earlier for Android) fails to initiate or enforce Bluetooth pairing and bonding. Because the application and the paired watch do not enforce these security measures, data transmitted via Bluetooth Low Energy (BLE) remains unencrypted. This oversight allow...
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-7585-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7585-1 advisory. It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when...
PT-2025-26313 · Coros · Coros Pace 3
Name of the Vulnerable Software and Affected Versions: COROS PACE 3 devices versions through 3.0808.0 Description: An issue was discovered in the BLE implementation of the COROS smartwatch, which does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In this pairing metho...
PT-2025-26315 · Coros · Coros Pace 3
Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions 3.0808.0 and earlier Description: An issue was discovered that allows an attacker to connect to the device via Bluetooth Low Energy BLE if no other device is connected. Once connected, the attacker can access the device'...
PT-2025-26317 · Coros · Coros Pace 3
Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An out-of-bounds read vulnerability exists in COROS PACE 3. Sending a crafted Bluetooth Low Energy BLE message forces the device to reboot. Recommendations: Update COROS PACE 3 to a version...
PT-2025-26320 · Coros · Coros
Name of the Vulnerable Software and Affected Versions: COROS application versions 3.8.12 and earlier Description: The issue concerns the COROS application's handling of Bluetooth pairing and bonding. The application does not initiate or enforce pairing and bonding, and the watch also does not...
CVE-2025-32875
An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing...
CVE-2025-32876
An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key STK can be easily guessed. This requires knowledge of the...
COROS PACE 3 安全漏洞
COROS PACE 3 is a GPS sports watch from COROS China. A security vulnerability exists in COROS PACE 3 3.0808.0 and prior versions, which stems from a BLE implementation that only supports older pairings and could lead to communication eavesdropping...
COROS application 安全漏洞
COROS application is a mobile application that accompanies sports wearable gear from the Chinese company COROS. A security vulnerability exists in COROS application version 3.8.12 and earlier, which stems from unencrypted Bluetooth pairing and bonding, and could lead to a man-in-the-middle attack...
COROS PACE 3 安全漏洞
COROS PACE 3 is a GPS sports watch from COROS China. A security vulnerability exists in COROS PACE 3 3.0808.0 and prior versions, which stems from a failure to require authentication for BLE services, which could lead to tampering with the device configuration...
CVE-2025-32879
The COROS PACE 3 GPS sports watch is vulnerable in versions 3.0808.0 and earlier due to a lack of authentication for Bluetooth Low Energy (BLE) services. The device starts advertising if no other device is connected, allowing an attacker to establish a BLE connection. Once connected, the attacker...