What is CVE-2025-32879?

CVE-2025-32879 is a high-severity vulnerability in Yftech Coros_pace_3, classified under Improper Authentication. CVSS score: 8.8/10. Published 2025-06-20.

How severe is CVE-2025-32879?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Yftech Coros_pace_3

CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, n…

Vulnerability class: Broken Authentication

EPSS: 0.005 (36.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Yftech Coros_pace_3
Yftech Coros_pace_3_firmware
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication
CWE-306 — Missing Authentication for Critical Function

References

cve@mitre.org (Third Party Advisory)
cve@mitre.org (Release Notes)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2025-32879?: CVE-2025-32879 is a high-severity vulnerability in Yftech Coros_pace_3, classified under Improper Authentication. CVSS score: 8.8/10. Published 2025-06-20.
How severe is CVE-2025-32879?: High severity. CVSS v3 base score is 8.8 out of 10.