Skullcandy Dime 3 Earbuds Vulnerable to Bluetooth Hijacking
Vulnerability Disclosure · 6 sources · Updated 2mo ago · First seen Aug 4, 2025
CERT/CC warned that Skullcandy Dime 3 wireless earbuds, model S2DCW, running firmware 1.0.0.28 are vulnerable to CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker within Bluetooth range can pair with the earbuds without a PIN, user approval, or physical access, then reconnect as a trusted device to interrupt or hijack audio, access headset functions, and potentially capture live microphone audio.
Skullcandy remediated the flaw in firmware 1.0.0.30, but owners of already-sold vulnerable units reportedly have no consumer-accessible update path, including through the Skullcandy app. The Airoha SDK issue affects audio devices from multiple vendors; Airoha released SDK updates in August 2025, while Apple issued a firmware fix for affected Beats Studio Buds.
