Affected Products and Remediation
Most COROS watches and bike computers; tested version: PACE 3 ≤ 3.0808.0. Remediation: update the watch firmware to the official security patch version.
Description and Impact
The pairing and encryption mechanisms used by the device in some Bluetooth connection scenarios have a security weakness. Under certain conditions, an attacker within Bluetooth communication range may exploit this issue to eavesdrop on Bluetooth communication between the device and other devices, resulting in disclosure of transmitted information.
Mitigation Measures
Use the COROS App to update your device firmware to the latest version to receive the relevant Bluetooth security fixes. Until the update is complete, we recommend avoiding initial pairing in public places and reducing the risk of exposure as much as possible when the device is disconnected from your phone.
Acknowledgments
We thank the following researcher for their contribution to product security:
- Moritz Abrell (SySS GmbH)
Revision History
v1.0 ｜ 2026-10-13