CMF Watch Pro 3 by Nothing

CMF Watch Pro 3 by Nothing
Security Grade C Calculator v	CMF Watch Pro 3 Brand: CMF by Nothing (Parent: Nothing Technology Limited) Category: Smartwatch / Wearable • Model / Gen: CMF Watch Pro series (3rd generation) CMF Watch Pro 3 (D399) Release Date: 2025-07-22 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	(community discussion on CMF Watch Pro 3 modification) 🔗 Proof	No official bootloader-unlock method is provided by Nothing for the CMF Watch Pro 3, and the device runs a proprietary RTOS rather than Android/Wear OS, which removes standard fastboot/adb interfaces by default. However, the Nothing Community contains active threads where owners discuss firmware testing and update behavior for the CMF Watch line, and the platform is open to community experimentation in a way that fully closed vendors are not. “Rare” reflects the absence of a published, user-accessible unlock path while acknowledging a community-modding culture around Nothing devices.
Known vulnerabilities	Rare	(no CMF Watch Pro 3-specific CVE identified as of classification date) https://nothing.community/d/... (security discussion, no confirmed CVE) 🔗 Proof	As of the classification date, no CMF Watch Pro 3-specific CVE has been published in NVD or other major vulnerability databases. The device runs a proprietary RTOS, not Android, which reduces exposure to the Android CVE ecosystem. “Rare” reflects the absence of a device-specific vulnerability record, not a claim of zero vulnerabilities.
Prior attacks	None	[No public incident reports identified 🔗 Proof]	No public report of targeted attacks or in-the-wild exploitation campaigns against CMF Watch Pro 3 users has been identified. The device’s short market presence (launched July 2025) and proprietary RTOS foundation limit the documented attack history.
Updatability	Rare	(community discussion on update frequency for CMF Watch 3) https://baike.baidu.com/item/CMF Watch Pro 3/66242846 (launch coverage, no published long-term update commitment) 🔗 Proof	Nothing has not published a formal, binding security-update commitment (cadence or end-of-support date) for the CMF Watch Pro 3. The Nothing Community contains threads where users question the update roadmap for the CMF Watch 3, and there is no official equivalent to OnePlus/Samsung’s published multi-year patch schedules. The device has received firmware updates (e.g., version 1.0.1.73 in December 2025), demonstrating active maintenance, but the absence of a published lifecycle commitment prevents a “Very common” rating. “Rare” reflects maintenance capability without a published, binding schedule.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The watch pairs with Android and iOS devices via the Nothing X app and supports Strava and Apple Health data synchronization. However, unified SSO across third-party identity providers is not a native “Full” capability. Authentication is scoped to the Nothing/CMF ecosystem, with partial bridging to health platforms.
Communications	Encrypted with up-to-date encryption	(Nothing privacy policy covering wearable data transmission) 🔗 Proof	Communications between the watch and the paired phone/Nothing cloud services are encrypted in transit using modern TLS/HTTPS as part of Nothing’s data-handling framework. The product page does not separately list cryptographic protocol versions, so this rating relies on the vendor’s platform-level privacy and security framework.
Storage	Encrypted with up-to-date encryption	(wearable data protection statement) 🔗 Proof	Health and personal data stored on the watch and synced to the Nothing X app are handled under Nothing’s privacy and data-protection framework, which includes encryption of sensitive data at rest and in transit. The exact on-device encryption implementation is not publicly detailed, so this rating should be treated as vendor-framework-based, not independently verified.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	The watch pairs with the Nothing X app for data sync and management. As a wearable, its account lifecycle is dependent on the paired phone and the Nothing/CMF account system; it does not provide the full standalone account-management surface of a smartphone or PC.
Authentication	Basic	🔗 Proof	The CMF Watch Pro 3 does not feature biometric authentication (no fingerprint, no 3D face recognition) in official specifications. Unlock relies on PIN or pattern on the paired device; the watch itself has no independent biometric authenticator. “Basic” reflects this capability tier.
Brute-force protection	Basic	[Proprietary RTOS platform behavior 🔗 Proof]	The RTOS platform typically implements basic rate limiting or lockout for paired-device unlock attempts, but the watch does not expose configurable, auditable brute-force protection policies comparable to Android smartphones. “Basic” reflects the presence of a standard lockout mechanism without enterprise-grade policy controls.
Event logging	Partial logging	[Proprietary RTOS platform behavior 🔗 Proof]	The watch records basic access and health-data events (workout logs, health measurements, notification access), but its event-logging surface is limited compared with a smartphone or PC. No public documentation describes a comprehensive, user-accessible security audit log on the device.
Passwords	Default/Common/Easy to guess	🔗 Proof	The watch relies on the paired device’s PIN/pattern rather than a full account password with enforced complexity requirements. No forced periodic-change policy or enterprise-grade complexity enforcement is documented for the watch unlock credential. “Default/Common/Easy to guess” reflects the credential type (short numeric PIN on the paired device) rather than a specific known weak default.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Proprietary RTOS (not Android/Wear OS; requires the Nothing X companion app) (Companion App: Nothing X (replaces the previous CMF Watch app))
Hardware (CPU / GPU)	CPU: Not publicly specified in official materials • GPU: Not applicable / not published
Memory & Storage	Memory: Not publicly specified in official materials • Storage: Not publicly specified in official materials
Power, Battery & Charging	Battery: 350 mAh; typical usage up to 13 days • Power: Magnetic charging (full charge in approximately 99 minutes) • Charging: Magnetic pin charging
Display & Camera	Display: 1.43-inch AMOLED, 466 × 466, 60 Hz, peak brightness 650 nits • Camera: None
Sound & Connectivity	Sound: Built-in microphone (added for improved call quality); no speaker for media playback • Connectivity: Dual-band five-system GPS, Bluetooth 5.x, IP68 dust/water resistance
Physical (Dimensions & Mass)	Dimensions: 47 mm × 47 mm × 14.4 mm (case) • Mass: 51 g (including strap)

Classification target is CMF Watch Pro 3, launched 2025-07-22. The device runs a proprietary RTOS (not Android/Wear OS), which removes standard adb/fastboot exposure and supports a “Rare” rating for Known hardware tampering—though Nothing’s community-modding culture and active firmware-testing discussions on the Nothing Community prevent a “None” rating. Updatability = Rare is driven by the absence of a published, binding security-update commitment for the CMF Watch line; the device has received firmware updates (e.g., v1.0.1.73, December 2025), demonstrating maintenance capability, but no formal cadence or end-of-support date is published. Authentication = Basic because the watch has no biometric sensors and relies on the paired device’s PIN/pattern. No CMF Watch Pro 3-specific CVE or prior attack has been identified.