CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device require any authentication or security level. Therefore, any characteristic, depending on their mode of operation (read/write/notify), can be used by the connected attacker. This allows, for example, configuring the device, sending notifications, resetting the device to factory settings, or installing software.

• CWE-287
• CWE-306

• https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-NotesRelease Notes
• https://syss.deThird Party Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-026.txtExploit, Third Party Advisory

Published

Jun 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32873An issue was discovered in Django 4.2 before 4.2.21, 5.1 bef…5.3
• CVE-2025-32874An issue was discovered in Kaseya Rapid Fire Tools Network D…7.5
• CVE-2025-32875An issue was discovered in the COROS application through 3.8…5.7
• CVE-2025-32876An issue was discovered on COROS PACE 3 devices through 3.08…6.8
• CVE-2025-32877An issue was discovered on COROS PACE 3 devices through 3.08…9.8
• CVE-2025-32878An issue was discovered on COROS PACE 3 devices through 3.08…9.8
• CVE-2025-3288A local code execution vulnerability exists in the Rockwell …7.8
• CVE-2025-32880An issue was discovered on COROS PACE 3 devices through 3.08…9.8
• CVE-2025-32881An issue was discovered on goTenna v1 devices with app 5.5.3…6.5
• CVE-2025-32882An issue was discovered on goTenna v1 devices with app 5.5.3…6.5
• CVE-2025-32883Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2025-32884An issue was discovered on goTenna Mesh devices with app 5.5…6.5