COROS PACE 3 NULL Pointer Dereference Vulnerability Leading to Denial-of-Service

A NULL pointer dereference vulnerability has been identified in the COROS PACE 3 smartwatch, affecting versions through 3.0808.0. This vulnerability allows an attacker to send a crafted Bluetooth Low Energy (BLE) message that forces the device to reboot. Exploiting this issue during an active workout session disrupts the activity and results in the loss of recorded data.

Impact

Exploitation of this vulnerability causes the device to reboot, interrupting any ongoing activities and erasing recorded data.

Reproduction

The vulnerability can be reproduced by connecting to the COROS PACE 3 via Bluetooth and writing a specific byte sequence to a designated characteristic. This action triggers the watch to reboot, demonstrating the denial-of-service effect.