COROS PACE 3 Out-of-Bounds Read Vulnerability Leading to Device Reboot

A vulnerability allowing an out-of-bounds read has been identified in the COROS PACE 3 smartwatch, affecting versions through 3.0808.0. This vulnerability arises from improper handling of Bluetooth Low Energy (BLE) messages, which can be exploited to cause the device to reboot. When the watch is rebooted, any ongoing activity is abruptly terminated, resulting in the loss of recorded data.

Impact

Exploitation of this vulnerability causes the smartwatch to reboot, disrupting any active tasks and erasing unsaved data.

Reproduction

The vulnerability can be reproduced by connecting to the COROS PACE 3 via Bluetooth and writing specific byte sequences to a designated characteristic. The first byte sequence, 'b900', is sent followed by '0000'. This sequence triggers the out-of-bounds read vulnerability, causing the watch to reboot.