Search: “pairing”

500 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 501 Malware 302 Ransomware 301 Industry 255 Policy & legal 253 Exploit / PoC 241 Data breach 166 Phishing & fraud 164 Threat actor 131 Research 88 AI research 66 AI safety & security 59 AI industry 49 AI tools & infra 36

SeverityAll critical 951 high 529 medium 468 low 451 info 279

VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.

CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.

CERT/CC Vulnerability NotesSep 8, 14:42 UTC · 8d agoVulnerability CVE-2025-20701

French intel found flaws in Bluetooth Core and Mesh specs

Security AffairsMay 24, 21:55 UTC · May 24, 2021Vulnerability CVE-2020-26559 CVE-2020-26556 CVE-2020-26557+3 CVEs

Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Spy Through Microphone

Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing via Airoha SDK flaw CVE-2025-20701, enabling audio hijack and microphone capture.

CERT/CC vulnerability note VU#859658 describes insecure Bluetooth Classic (BR/EDR) pairing on Skullcandy Dime 3 (model S2DCW) firmware 1.0.0.28, linked to CVE-2025-20701 in the Airoha Bluetooth audio SDK. The NoInputNoOutput I/O capability lets unknown nearby devices pair without pairing mode, PIN, passkey or user interaction, then bond and automatically reconnect. An attacker can hijack the A2DP audio session and access Hands-Free or Headset profiles to capture live microphone audio. Firmware 1.0.0.30 reportedly fixes the flaw, but the earbuds cannot be updated through the Skullcandy app, leaving current users without a consumer-accessible patch path.

Cyber Security NewsSep 11, 04:16 UTC · 5d agoVulnerability 2 sources CVE-2025-20701

BLURtooth flaw allows attacking Bluetooth encryption process

Security AffairsSep 10, 11:47 UTC · Sep 10, 2020Vulnerability CVE-2020-15802

Bluetooth BIAS attack threatens billions of devices

Security AffairsMay 19, 22:04 UTC · May 19, 2020Vulnerability

Bluetooth vulnerability allows snooping of traffic between paired devices

Help Net SecurityOct 15, 12:29 UTC · Oct 15, 2018Vulnerability CVE-2018-5383

Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking

CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.

CERT/CC reports the Skullcandy Dime 3 (model S2DCW) running firmware 1.0.0.28 is affected by CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker in close range can pair without user interaction, then hijack audio playback, access the headset profile, and capture live microphone audio. Skullcandy fixed the issue in firmware 1.0.0.30, but existing units have no consumer-accessible update path via the app. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched it for Beats Studio Buds in June.

BleepingComputerSep 9, 21:02 UTC · 7d agoVulnerability CVE-2025-20701

Attackers hit pair of critical Fortinet vulnerabilities the vendor disclosed in April

CyberScoopJun 18, 14:32 UTC · Jun 18, 2026Vulnerability in the wildCVE-2026-39808 CVE-2026-39813 CVE-2026-25089

PerfektBlue Bluetooth Vulnerabilities Expose Millions of Vehicles to Remote Code Execution

The Hacker NewsJul 12, 12:32 UTC · Jul 12, 2025Vulnerability CVE-2024-45434 CVE-2024-45431 CVE-2024-45433+1 CVEs

Contrast Northstar pairs runtime data and contextual analysis with AI-powered auto-remediation

Help Net SecurityJun 9, 00:00 UTC · Jun 9, 2025Vulnerability

Z-Wave Downgrade Attack Left Over 100 Million IoT Devices Open to Hackers

The Hacker NewsMay 25, 09:16 UTC · May 25, 2018Vulnerability

‘Locked Out’

Kaspersky SecurelistMar 12, 11:00 UTC · Mar 12, 2015Vulnerability

Nintendo Switch QR Code Vulnerability Lets Nearby Attackers Execute Unauthorized Code

Nintendo patched CVE-2026-82079 (CVSS 8.4), a stack buffer overflow in Switch local wireless pairing enabling nearby attackers to execute code.

Nintendo Switch system update 23.0.0 fixes CVE-2026-82079, a stack-based buffer overflow in local wireless networking abused via the QR code sharing process, including Album's 'Send to Smartphone' and Mario Kart Live pairing. A nearby attacker who scans the displayed QR code can send crafted traffic and use return-oriented programming to achieve arbitrary code execution. CVSS scores are 8.4 (v3.1) and 7.0 (v4.0), both rated High. No in-the-wild exploitation is reported and Switch 2 systems are not affected.