Coros Pace 3 Firmware CVE-2025-48705

CVSS 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates high availability impact with no authentication required and low attack complexity. However, the impact is limited to availability (A:H) with no confidentiality or integrity compromise (C:N/I:N). Real-world risk assessment: Without EPSS data or public POC confirmation, this should be treated as moderate-to-high priority depending on deployment context. The lack of authentication requirement and low complexity increase exploitability likelihood. This is NOT a critical vulnerability in absolute terms (no data exfiltration, no code execution potential), but represents a nuisance denial-of-service vector that could be leveraged by threat actors to disable fitness tracking during critical activities or in scenarios where device reliability is mission-critical (e.g., athletes during competition, outdoor adventurers). SSVC considerations: Exploitation is likely remotely exploitable (automatable via BLE scanning/fuzzing), but technical impact is limited to service availability. Recommend prioritization as Medium-High for consumer/prosumer segments, High for professional/enterprise deployments where device continuity matters.

An attacker with a BLE-capable device (smartphone, laptop, or specialized Bluetooth sniffer like a Raspberry Pi with Bluetooth module) identifies a COROS PACE 3 within Bluetooth range. The attacker uses a custom script or modified firmware to craft a malformed BLE message that violates the expected BLE GATT protocol structure, specifically one that causes the device's message parser to dereference a NULL pointer. No user interaction is required—the attack is passive from the device owner's perspective. Upon receiving the crafted message, the PACE 3 firmware crashes with an unhandled NULL pointer exception, triggering an automatic reboot cycle. If repeated, this creates a denial-of-service condition where the device repeatedly reboots, rendering it unusable for fitness tracking until manually powered off or until the attacker ceases transmission. A proof-of-concept would likely involve tools like Bleah, BlueZ, or custom Python BLE libraries to construct raw GATT packets targeting the vulnerable code path. This scenario is highly plausible given the low AC (attack complexity) and no PR (privileges) requirement in the CVSS vector.