Bluetooth Audio SDK Vulnerability in Airoha Products
CVE-2025-20701
Key Information:
- Vendor
Airoha Technology Corp.
- Vendor
- CVE Published:
- 4 August 2025
Badges
What is CVE-2025-20701?
A flaw exists in the Airoha Bluetooth audio SDK that potentially allows attackers to pair Bluetooth audio devices without the explicit consent of the user. This vulnerability can lead to unauthorized access and privilege escalation without requiring any user interaction, thereby posing a significant risk to the security and privacy of users. A detailed security bulletin is available for further insights.
Affected Version(s)
AB156x, AB157x, AB158x, AB159x series Airoha IoT SDK for BT audio v5.5.0 and earlier
AB156x, AB157x, AB158x, AB159x series Airoha AB1561x/AB1562x/AB1563x SDK v3.3.1 and earlier
News Articles
Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking
The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction.
The Hacker NewsCVE-2025-20701Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone
Apple fixed CVE-2025-20701 in Beats Studio Buds firmware 1B211, closing a Bluetooth pairing flaw that could allow nearby eavesdropping via Airoha SDK.
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations
Apple has released security updates to patch a high-severity flaw affecting the Beats Studio Buds wireless earbuds that could allow attackers in Bluetooth range to spy on users' conversations.
References
EPSS Score
7% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit known to exist
- 📰
First article discovered by BleepingComputer
Vulnerability published
Vulnerability Reserved