Critical · published June 20, 2025
🚨 Watch out! COROS PACE 3 devices are shouting "I'm unguarded!" thanks to a serious flaw in versions up to 3.0808.0 that allows attackers to pair without permission! 🔥 Think of it like a hotel room that lets anyone walk in without a keycard — the front desk doesn’t even ask for an ID! With the Just Works pairing method in play, attackers can easily step into your device's private space without any authentication checks. This is absolutely devastating! An attacker could remotely interact with your COROS PACE 3, hijacking BLE communications to gather sensitive data or manipulate device functions. Without proper authentication, it's an open invitation for a machine-in-the-middle attack, compromising your device's security.
Think of it like a hotel room that lets anyone walk in without a keycard — the front desk doesn’t even ask for an ID! With the Just Works pairing method in play, attackers can easily step into your device's private space without any authentication checks. This vulnerability arises from the Just Works pairing method utilized by the COROS PACE 3, which lacks any authentication mechanism. This design flaw allows attackers to connect to the device via Bluetooth Low Energy (BLE) without prior authorization, exposing it to potential exploitation.
This is absolutely devastating! An attacker could remotely interact with your COROS PACE 3, hijacking BLE communications to gather sensitive data or manipulate device functions. Without proper authentication, it's an open invitation for a machine-in-the-middle attack, compromising your device's security. Immediately update your COROS PACE 3 devices to the latest firmware version that addresses this vulnerability. If you manage these devices in a larger system, ensure that any connecting applications also enforce security best practices. Stay vigilant about BLE communications and consider additional security layers if possible. This is fixable! Follow these steps and you'll enhance the security of your devices in no time! 🛡️