Moritz Abrell

A highly authenticated attacker can modify the configuration generator by injecting a payload into future configurations. The device fails to properly validate this configuration value before passing it to a system execution, leading to arbitrary code execution. This may result in a total loss of confidentiality, integrity, and availability.

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on a USB stick, leading to code execution. This may result in a total loss of confidentiality, integrity, and availability.

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified) Description An unauthenticated remote attacker can access a configuration file containing database credentials, potentially leading to a loss of confidentiality. There is no exposed endpoint to utilize these credentials. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the `mb24api` endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Name of the Vulnerable Software and Affected Versions versions not specified Description An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the `getinfo` endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A remote attacker can exploit an RCE vulnerability due to the improper neutralisation of special elements used in an OS command within the `generateSrpArray()` function, potentially leading to full system compromise. This attack requires the attacker to have a pre-existing ability to write arbitrary data to the user table.

Name of the Vulnerable Software and Affected Versions MB connect line mbCONNECT24 (affected versions not specified) Description An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the `setinfo` endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An unauthenticated remote attacker can exploit a remote code execution issue in the com mb24sysapi module, potentially leading to full system compromise. The root cause is the improper neutralisation of special elements used in an OS command. This is a variant of a previously known issue.

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An out-of-bounds read vulnerability exists in COROS PACE 3. Sending a crafted Bluetooth Low Energy (BLE) message forces the device to reboot. Recommendations: Update COROS PACE 3 to a version beyond 3.0808.0.

Name of the Vulnerable Software and Affected Versions: COROS application versions 3.8.12 and earlier Description: The issue concerns the COROS application's handling of Bluetooth pairing and bonding. The application does not initiate or enforce pairing and bonding, and the watch also does not enforce these security measures. As a result, data transmitted via Bluetooth Low Energy (BLE) remains unencrypted, allowing attackers within range to intercept the communication. Even if a user manually initiates pairing and bonding in the Android settings, the application continues to transmit data without requiring the watch to be bonded, enabling attackers to exploit the communication. This could be used to conduct an active machine-in-the-middle attack. Recommendations: For versions 3.8.12 and earlier, as a temporary workaround, consider disabling Bluetooth functionality in the COROS application until a patch is available. Restrict access to sensitive data transmitted via BLE to minimize the risk of exploitation. Avoid using the COROS application for sensitive communications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions 3.0808.0 and earlier Description: The issue is caused by a NULL pointer dereference vulnerability. Sending a crafted BLE message can force the device to reboot. Recommendations: For COROS PACE 3 versions 3.0808.0 and earlier, as a temporary workaround, consider restricting the reception of BLE messages from untrusted sources until a patch is available.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that allows the COROS Pace 3 to download firmware files via HTTP when connected to a WLAN, but the communication is not encrypted. This lack of encryption enables sniffing and machine-in-the-middle attacks. Recommendations: For COROS PACE 3 versions through 3.0808.0, as a temporary workaround, consider restricting WLAN access to trusted networks until a patch is available. Avoid using the watch's WLAN connectivity feature in untrusted environments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions 3.0808.0 and earlier Description: An issue was discovered that allows an attacker to connect to the device via Bluetooth Low Energy (BLE) if no other device is connected. Once connected, the attacker can access the device's BLE services and characteristics without any authentication or security level, enabling them to configure the device, send notifications, reset the device to factory settings, or install software. Recommendations: For COROS PACE 3 versions 3.0808.0 and earlier, as a temporary workaround, consider disabling the Bluetooth advertising feature when no device is connected to minimize the risk of exploitation. Restrict access to the device's BLE services and characteristics to prevent unauthorized configuration or control.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 devices versions through 3.0808.0 Description: An issue was discovered in the BLE implementation of the COROS smartwatch, which does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In this pairing method, the Short-Term Key (STK) can be easily guessed, requiring knowledge of the Temporary Key (TK), which is set to 0 due to the Just Works pairing method. This allows an attacker within Bluetooth range to perform sniffing attacks, enabling eavesdropping on the communication. Recommendations: For COROS PACE 3 devices versions through 3.0808.0, consider disabling Bluetooth functionality until a patch is available to mitigate the risk of sniffing attacks. Restrict access to sensitive information on the device to minimize the risk of eavesdropping. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that allows an attacker to eavesdrop and manipulate HTTPS communication. The device does not validate the X.509 server certificate within the TLS handshake, enabling an attacker in an active machine-in-the-middle position to exploit this using a TLS proxy and a self-signed certificate. This could be abused to steal the API access token of the assigned user account. Recommendations: For COROS PACE 3 versions through 3.0808.0, as a temporary workaround, consider disabling the WLAN connection function until a patch is available to validate the X.509 server certificate. Restrict access to sensitive information, such as API access tokens, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that affects the Bluetooth pairing method of the device. It identifies itself as a device without input or output capabilities, resulting in the use of the Just Works pairing method. This method does not implement any authentication, allowing machine-in-the-middle attacks. Furthermore, this lack of authentication allows attackers to interact with the device via Bluetooth Low Energy (BLE) without requiring prior authorization. Recommendations: For COROS PACE 3 versions through 3.0808.0, as a temporary workaround, consider restricting access to the device's BLE functionality until a patch is available. Additionally, users should be cautious when pairing their devices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue was discovered due to the use of weak password obfuscation/encryption. An attacker with access to configuration exports (INI) is able to decrypt the passwords.

A path traversal issue allows sensitive data to be read without any authentication. This means that an attacker could potentially access confidential information by manipulating file paths.

An issue was discovered due to the use of a hard-coded key, allowing an attacker to decrypt sensitive data, such as passwords extracted from the topology file.