Affected Products and Remediation
Most COROS watches and bike computers (WLAN functionality); tested version: PACE 3 ≤ 3.0808.0. Remediation: update the watch firmware to the official security patch version.
Description and Impact
Before downloading firmware over WLAN, the watch requests firmware information from the backend API via HTTPS but does not validate the X.509 server certificate during the TLS handshake. An attacker in a man-in-the-middle position can eavesdrop on and modify this communication, potentially stealing the API access token for the user's account. Exploitation requires the attacker to be on the same network and able to carry out a man-in-the-middle attack.
Mitigation Measures
Until the update is complete, avoid using the WLAN firmware download feature on untrusted Wi-Fi networks.
Acknowledgments
We thank the following researcher for their contribution to product security:
- Moritz Abrell (SySS GmbH)
Revision History
v1.0 ｜ 2026-10-13