Security Bulletins

COROS is committed to protecting the security of its products, services, and users' information. We publish confirmed security vulnerabilities and their resolution status here to help users understand the associated security risks and promptly take the necessary protective measures or install updates.

This page is updated regularly.

Vulnerability TitleBluetooth Communication Does Not Enforce Encryption

CVE IDCVE-2025-32875

Internal IDCOROS-SA-2025-001

Publication Date2026-10-13

Vulnerability TitleSecurity Weakness in Bluetooth Pairing and Encryption

CVE IDCVE-2025-32876

Internal IDCOROS-SA-2025-002

Publication Date2026-10-13

Vulnerability TitleBluetooth Pairing Lacks Device Authentication (Just Works)

CVE IDCVE-2025-32877

Internal IDCOROS-SA-2025-003

Publication Date2026-10-13

Vulnerability TitleFirmware Information Interface Does Not Validate the Server Certificate

CVE IDCVE-2025-32878

Internal IDCOROS-SA-2025-004

Publication Date2026-10-13

Vulnerability TitleBluetooth Services Are Accessible Without Authentication

CVE IDCVE-2025-32879

Internal IDCOROS-SA-2025-005

Publication Date2026-10-13

Vulnerability TitleWLAN Firmware Downloads Use Unencrypted HTTP

CVE IDCVE-2025-32880

Internal IDCOROS-SA-2025-006

Publication Date2026-10-13

Vulnerability TitleCrafted Bluetooth Messages Can Cause Device Reboots (Null Pointer Dereference)

CVE IDCVE-2025-48705

Internal IDCOROS-SA-2025-007

Publication Date2026-10-13

Vulnerability TitleCrafted Bluetooth Messages Can Cause Device Reboots (Out-of-Bounds Read)

CVE IDCVE-2025-48706

Internal IDCOROS-SA-2025-008

Publication Date2026-10-13