Affected Products and Remediation
COROS Android app ≤ V3.8.12 (affects communication with all watch models paired with the app). Remediation: update the Android app to the latest version and update the watch firmware as well.
Description and Impact
The app neither initiates nor enforces pairing and bonding, and the watch does not enforce link encryption. Data transmitted over Bluetooth is therefore not protected by encryption. An attacker within range can intercept plaintext communication and may eavesdrop on or modify it through a man-in-the-middle attack.
Mitigation Measures
Update both the COROS App and your watch firmware to the latest versions. Until the updates are complete, we recommend pairing your device in a secure, non-public environment and avoiding connecting it for the first time in public places.
Acknowledgments
We thank the following researcher for their contribution to product security:
- Moritz Abrell (SySS GmbH)
Revision History
v1.0 ｜ 2026-10-13