Critical Vulnerabilities in Airoha-Based Bluetooth Headphones Enable Device Hijacking

Security researchers have identified and disclosed several critical vulnerabilities in Bluetooth headphones and earbuds powered by Airoha Bluetooth System-on-Chips (SoCs), which are widely used by major brands such as Sony, Bose, JBL, Marshall, and Jabra. The vulnerabilities, tracked as CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, allow attackers within Bluetooth range to eavesdrop on conversations, steal sensitive data, and potentially hijack connected smartphones. The most severe flaw, related to the RACE (Remote Access Control Engine) protocol, enables remote code execution and arbitrary memory access due to missing authentication mechanisms in both Bluetooth Low Energy and Classic modes. Despite initial disclosure in June 2025 and the availability of patches, many affected devices remain unpatched, increasing the risk of exploitation.

The RACE protocol, originally designed for factory debugging and firmware updates, is exposed over multiple interfaces, including Bluetooth and USB HID, providing attackers with powerful capabilities if exploited. Researchers have released a white paper and the RACE Toolkit to help users and security professionals assess device vulnerability. The ongoing exposure of these flaws highlights the importance of timely patching and the risks associated with insecure default configurations in widely deployed consumer electronics. Users of affected headphones and earbuds are urged to check for firmware updates and apply patches as soon as possible to mitigate the risk of compromise.