Coros Pace 3 Firmware CVE-2025-32880

CVSS 9.8 with AV:N (network-accessible), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), and C:H/I:H/A:H (high impact across confidentiality, integrity, availability) accurately reflects the severity. This is not inflated: an attacker on the same WLAN or upstream network can passively sniff the firmware download, then actively inject a backdoored firmware image that persists across reboots and grants full device control. The attack is trivial (AC:L) and requires no special privileges, making exploitation highly probable. The CVSS vector aligns with real-world impact—a compromised wearable can leak health/location data, participate in botnet attacks, or become a persistent spy device. Absent KEV/CISA inclusion confirmation or public POC disclosure in the data provided, this remains in the high-priority-but-not-yet-weaponized category; however, the simplicity of the attack (man-in-the-middle on HTTP) means a POC would be trivial to develop. From an SSVC perspective: exploitation is being developed or proof-of-concept exists (network-level MITM tools are commodity), the attack is automatable (no user-specific constraints), and technical impact is total (arbitrary code execution on device). This should be treated as an immediate priority for patch deployment.

An attacker on a coffee shop WLAN (or with compromised router access) sets up an ARP spoofing or DNS poisoning attack to intercept the COROS PACE 3 device's firmware update request. The device initiates an HTTP GET request to download firmware from a CDN or official COROS server. The attacker's man-in-the-middle proxy intercepts the request and responds with a malicious firmware image containing a backdoor. Since the firmware download is unencrypted and unsigned, the device accepts the malicious image without validation. The compromised firmware persists after reboot and could exfiltrate GPS location data, heart rate/health metrics, or user credentials stored on the watch. The attacker gains silent, persistent access to a device that is worn and trusted by the victim. No user-facing error messages or warnings are displayed because the device has no cryptographic means to distinguish authentic from malicious firmware. This scenario is highly realistic given the prevalence of public WiFi and the low skill barrier to execute HTTP interception attacks using tools like mitmproxy or arpspoof.