Affected Products and Remediation
Most COROS watches and bike computers; tested version: PACE 3 ≤ 3.0808.0. Remediation: update the watch firmware to the official security patch version.
Vulnerability Description and Impact
When no device is connected, the watch actively advertises over Bluetooth, allowing any attacker within range to establish a BLE connection. Once connected, none of the Bluetooth services or characteristics require authentication or a security level. An attacker can read or modify device settings, send notifications, perform a factory reset, or install software. Exploitation requires the attacker to be within Bluetooth range while the watch is not connected to another device.
Mitigation Measures
Update your watch firmware to the latest version. Until the update is complete, keep the watch connected to your phone whenever possible, and avoid leaving it disconnected for extended periods in public places.
Acknowledgments
We thank the following researcher for their contribution to product security:
- Moritz Abrell (SySS GmbH)
Revision History
v1.0 ｜ 2026-10-13