Product

Beats Studio Buds

1 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 9, 2026 · last 6d ago

Timeline1 articles

Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking

CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.

CERT/CC reports the Skullcandy Dime 3 (model S2DCW) running firmware 1.0.0.28 is affected by CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker in close range can pair without user interaction, then hijack audio playback, access the headset profile, and capture live microphone audio. Skullcandy fixed the issue in firmware 1.0.0.30, but existing units have no consumer-accessible update path via the app. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched it for Beats Studio Buds in June.

BleepingComputerupdated Sep 11, 04:16 UTC · 4d agofirst Sep 9, 21:02 UTC · 6d agoVulnerability 3 sources CVE-2025-20701

Related CVEsby mentions

CVE-2025-207018.89%
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent.
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
PoC —

Appears with

organization Carnegie Mellon University 1 organization CERT/CC 1 organization ERNW 1 product Airoha Bluetooth Audio SDK 1 product Skullcandy Dime 3 1 vendor Airoha 1 vendor Apple 1 vendor Skullcandy 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.