Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking
CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.
CERT/CC reports the Skullcandy Dime 3 (model S2DCW) running firmware 1.0.0.28 is affected by CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker in close range can pair without user interaction, then hijack audio playback, access the headset profile, and capture live microphone audio. Skullcandy fixed the issue in firmware 1.0.0.30, but existing units have no consumer-accessible update path via the app. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched it for Beats Studio Buds in June.
- CVE-2025-20701 is a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK
- Close-range attackers can pair silently, hijack playback, and capture live microphone audio
- Fix shipped in firmware 1.0.0.30, but existing units cannot be updated by customers
- ERNW researchers found the flaw, which affects earbud products from multiple vendors
- Apple patched the same SDK flaw for Beats Studio Buds in June
- CVEs
- CVE-2025-20701
- Vendors
- SkullcandyAirohaApple
- Organizations
- CERT/CCCarnegie Mellon UniversityERNW
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20701 | In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent | 8.8 | 8% | PoC |
From the original article
2 min read at bleepingcomputer.com
The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.