CVE-2025-32877 Auth bypass in n/a
Attackers can perform machine-in-the-middle attacks and interact with COROS PACE 3 devices via BLE without authorization due to missing authentication in Just Works pairing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32877?
CVE-2025-32877 is a critical authentication bypass vulnerability in n/a, published on 20 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle attacks. Furthermore, this lack of authentication allows attackers to interact with the device via BLE without requiring prior authorization.
Weakness: CWE-287
Which versions are affected by CVE-2025-32877?
It affects 1 product.
Products include Yftech Coros Pace 3 Firmware.
How do I fix CVE-2025-32877?
No fix has been published for CVE-2025-32877 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-32877 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32877 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9mq8-xcmp-hwr5.