CVE-2025-32878 Security feature bypass in n/a
Attackers can intercept HTTPS traffic to steal API tokens due to missing TLS certificate validation on COROS PACE 3 watches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32878?
CVE-2025-32878 is a critical vulnerability in n/a, published on 20 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for downloading firmware files. Before downloading firmware files, the watch requests some information about the firmware via HTTPS from the back-end API. However, the X.509 server certificate within the TLS handshake is not validated by the device. This allows an attacker within an active machine-in-the-middle position, using a TLS proxy and a self-signed certificate, to eavesdrop and manipulate the HTTPS communication. This could be abused, for example, for stealing the API access token of the assigned user account.
Weakness: CWE-295
Which versions are affected by CVE-2025-32878?
It affects 1 product.
Products include Yftech Coros Pace 3 Firmware.
How do I fix CVE-2025-32878?
No fix has been published for CVE-2025-32878 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32878 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32878 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8hrq-vv4f-qvxr.