Affected Products and Remediation
Most COROS watches and bike computers (the BLE protocol stack is shared across models); tested version: PACE 3 ≤ 3.0808.0. Remediation: update the watch firmware to the official security patch version.
Vulnerability Description and Impact
A null pointer dereference when processing crafted Bluetooth messages can force the device to reboot. Exploitation requires an attacker to be within Bluetooth range. The impact is on availability (data from an ongoing activity may be lost), with no data disclosure.
Mitigation Measures
Update your watch firmware to the latest version. Until the update is complete, avoid connecting to unknown Bluetooth devices in untrusted environments whenever possible.
Acknowledgments
We thank the following researcher for their contribution to product security:
- Moritz Abrell (SySS GmbH)
Revision History
v1.0 ｜ 2026-10-13