VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability
Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.
CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.
- Unauthenticated Bluetooth Classic pairing completes via NoInputNoOutput without pairing mode or confirmation.
- Attackers in radio range can hijack audio and capture microphone via the headset profile.
- No consumer-accessible firmware update path from 1.0.0.28 to patched 1.0.0.30.
- CVEs
- CVE-2025-20701
- Vendors
- SkullcandyAiroha Technology
- Products
- Skullcandy Dime 3
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20701 | In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent | 8.8 | 8% | PoC |
From the original article
2 min read at kb.cert.orgOverview Skullcandy Dime 3 wireless earbuds, running firmware version 1. 0. 0.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.