Loading story…
CERT/CC warned that Skullcandy Dime 3 wireless earbuds, model S2DCW, running firmware 1.0.0.28 are vulnerable to CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker within Bluetooth range can pair with the earbuds without a PIN, user approval, or physical access, then reconnect as a trusted device to interrupt or hijack audio, access headset functions, and potentially capture live microphone audio.
Skullcandy remediated the flaw in firmware 1.0.0.30, but owners of already-sold vulnerable units reportedly have no consumer-accessible update path, including through the Skullcandy app. The Airoha SDK issue affects audio devices from multiple vendors; Airoha released SDK updates in August 2025, while Apple issued a firmware fix for affected Beats Studio Buds.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Airoha published SDK updates intended to address CVE-2025-20701.
CERT/CC reported that Dime 3 model S2DCW earbuds running firmware 1.0.0.28 accept nearby pairing requests without user interaction, a PIN, or physical access. An unauthorized device can become trusted and reconnect to interrupt audio, access the headset profile, or capture live microphone audio.
Skullcandy remediated CVE-2025-20701 in Dime 3 firmware version 1.0.0.30. Owners of already-sold units running vulnerable version 1.0.0.28 reportedly have no consumer-accessible method, including the Skullcandy app, to install the update.
Apple addressed CVE-2025-20701 in Beats Studio Buds through a firmware update. The references conflict on whether that update was released in June 2025 or June 2026.
ERNW researchers discovered CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK, and presented the issue at the TROOPERS cybersecurity conference. The flaw affects Bluetooth audio products from multiple vendors using the SDK.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcemkd-cirt.mk
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple has released **Beats Firmware Update `1B211`** to fix a high-severity Bluetooth vulnerability in **Beats Studio Buds** that could let an attacker within wireless range listen through the earbuds’ microphone under limited conditions. The flaw, tracked as **`CVE-2025-20701`**, affected devices while they were **unpaired and actively seeking a pairing request**, allowing pre-pairing eavesdropping. Apple said the issue originated in **open source code** and noted that Apple software was among the affected projects. The bug was identified in **Airoha** system-on-chip code by researchers **Dennis Heinze** and **Frieder Steinmetz** of **ERNW GmbH**, who linked it to missing authentication in the Bluetooth **BR/EDR** radio. ERNW said the flaw could be chained with **`CVE-2025-20700`** and **`CVE-2025-20702`** to enable broader attacks against vulnerable headphones, including issuing phone commands, extracting link keys, accessing call history and contacts, and placing calls, though such attacks require close proximity and substantial technical skill. The update is delivered automatically when the earbuds are paired with an **iPhone, iPad, or Mac**, placed on a charger, and kept within Bluetooth range.
Jun 29, 2026
Researchers disclosed three vulnerabilities in Bluetooth audio devices built on Airoha systems-on-chip that can allow an attacker within radio range to gain unauthorized access to device memory and communications. The flaws, tracked as **`CVE-2025-20700`**, **`CVE-2025-20701`**, and **`CVE-2025-20702`**, stem from missing authentication in GATT and Bluetooth BR/EDR components and weak permission controls in a proprietary protocol, affecting headphones and earbuds sold by brands including **Sony, Bose, Jabra, JBL, Marshall, Beyerdynamic, and Teufel**. ERNW researchers said the bugs can be chained to hijack the Bluetooth link between a phone and an audio device, issue commands to the paired phone through the **Hands-Free Profile**, eavesdrop on conversations, and potentially overwrite firmware for remote code execution on the accessory. The attack requires proximity because exploitation is limited by Bluetooth range, but defenders were urged to apply vendor firmware updates and investigate or restart devices showing abnormal Bluetooth behavior.
Jul 24, 2026
Security researchers have identified and disclosed several critical vulnerabilities in Bluetooth headphones and earbuds powered by Airoha Bluetooth System-on-Chips (SoCs), which are widely used by major brands such as Sony, Bose, JBL, Marshall, and Jabra. The vulnerabilities, tracked as CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, allow attackers within Bluetooth range to eavesdrop on conversations, steal sensitive data, and potentially hijack connected smartphones. The most severe flaw, related to the RACE (Remote Access Control Engine) protocol, enables remote code execution and arbitrary memory access due to missing authentication mechanisms in both Bluetooth Low Energy and Classic modes. Despite initial disclosure in June 2025 and the availability of patches, many affected devices remain unpatched, increasing the risk of exploitation. The RACE protocol, originally designed for factory debugging and firmware updates, is exposed over multiple interfaces, including Bluetooth and USB HID, providing attackers with powerful capabilities if exploited. Researchers have released a white paper and the RACE Toolkit to help users and security professionals assess device vulnerability. The ongoing exposure of these flaws highlights the importance of timely patching and the risks associated with insecure default configurations in widely deployed consumer electronics. Users of affected headphones and earbuds are urged to check for firmware updates and apply patches as soon as possible to mitigate the risk of compromise.
Jun 29, 2026