Loading vulnerability…
Missing Authentication for BLE GATT Services in Airoha Bluetooth Audio SDK
CVE-2025-20700 is a missing-authentication vulnerability in the Airoha Bluetooth audio SDK affecting Bluetooth Low Energy GATT services. The flaw exposes access to the proprietary RACE protocol over BLE without requiring pairing or other authentication, allowing a nearby attacker to discover and connect to vulnerable audio devices and bypass intended permission controls protecting sensitive protocol functionality and data. The issue has been described as a permission bypass that enables access to critical RACE protocol data through the BLE GATT service and can serve as an entry point for broader compromise when combined with related flaws in the same platform.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A nearby unauthenticated attacker can silently connect to a vulnerable device over BLE and gain unauthorized access to sensitive RACE protocol functionality and data. This can result in bypass of security controls and remote escalation of privilege on the device without additional execution privileges or user interaction. In multi-step attack chains with related Airoha vulnerabilities, this access can contribute to extraction of device memory and Bluetooth trust material, impersonation of the trusted peripheral, and downstream abuse of the paired smartphone connection.
If you can’t patch tonight, do this now.
Until patched firmware is installed, reduce exposure by disabling Bluetooth when not needed, powering off affected audio devices when not in use, and avoiding use of vulnerable devices in environments where untrusted parties can come within Bluetooth range. Where operationally feasible, remove or limit discoverability and monitor for abnormal Bluetooth behavior such as unexpected disconnects or reconnection anomalies. Restarting the device and allowing it to reconnect normally may help if suspicious Bluetooth behavior is observed, but this is not a substitute for patching.
Patch, then assume compromise.
Apply the vendor-provided firmware or SDK updates that address the missing authentication condition in the BLE GATT service and restrict unauthenticated access to the RACE protocol. Device manufacturers using the affected Airoha SDK should integrate the updated SDK and ship firmware updates to end users. End users should install the latest firmware made available by their device vendor.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.