Loading vulnerability…
Unauthorized RACE Protocol Access in Airoha Bluetooth Audio SDK
CVE-2025-20702 is an authorization weakness in the Airoha Bluetooth audio SDK involving insufficient restriction of privileged functionality exposed through the proprietary RACE protocol. The protocol exposes internal management and debug-style capabilities that can be reached remotely over Bluetooth on affected devices. Available operations reportedly include retrieving device information, obtaining the Bluetooth Classic address, reading flash memory, and performing arbitrary read and write operations on RAM. Because access to these capabilities is not adequately restricted, a nearby attacker can gain unauthorized access to sensitive device internals and management functions without user interaction. In practical attack chains, this weakness can be combined with other Airoha Bluetooth authentication flaws to facilitate broader compromise of the audio device and its trusted relationship with a paired phone.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can give an attacker unauthorized access to privileged device-management capabilities, including extraction of sensitive configuration data from flash, arbitrary manipulation of RAM, and persistent alteration of device state. The exposed functionality can support theft of Bluetooth trust material, device impersonation, and compromise of the security boundary between the headset and a paired smartphone when chained with related flaws. Reported downstream effects of multi-vulnerability exploitation include hijacking Hands-Free Profile interactions, issuing commands to the phone, accessing call-related data depending on platform permissions, eavesdropping on conversations, and potentially modifying firmware or device behavior persistently.
If you can’t patch tonight, do this now.
Until patched firmware is installed, reduce exposure by disabling Bluetooth when not needed, limiting use of vulnerable devices in untrusted proximity environments, and powering devices off when not in use. Organizations and high-risk users should avoid relying on affected Bluetooth audio devices in sensitive settings, monitor for abnormal Bluetooth behavior, and remove or replace devices that do not receive vendor fixes. Because exploitation is proximity-based, physical separation from potential attackers reduces risk but does not eliminate it.
Patch, then assume compromise.
Apply vendor firmware updates that incorporate Airoha’s SDK fixes for the affected Bluetooth SoC implementation. Device manufacturers using the Airoha SDK should integrate the updated SDK and ship patched firmware that restricts or removes unauthenticated access to RACE functionality, especially memory access and management commands. Verify remediation by confirming the device is running the latest vendor-provided firmware and, where available, reviewing vendor advisories for explicit coverage of CVE-2025-20702 and related Airoha Bluetooth issues.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.