Search: “bluetooth”

9 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 10 Malware 6 Advisory 6 AI industry 3 Policy & legal 2 Industry 2 Tools 1 Exploit / PoC 1 AI research 1 Research 1 Threat actor 1

SeverityAll critical 1 high 10 medium 9 low 4 info 10

Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Spy Through Microphone

Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing via Airoha SDK flaw CVE-2025-20701, enabling audio hijack and microphone capture.

CERT/CC vulnerability note VU#859658 describes insecure Bluetooth Classic (BR/EDR) pairing on Skullcandy Dime 3 (model S2DCW) firmware 1.0.0.28, linked to CVE-2025-20701 in the Airoha Bluetooth audio SDK. The NoInputNoOutput I/O capability lets unknown nearby devices pair without pairing mode, PIN, passkey or user interaction, then bond and automatically reconnect. An attacker can hijack the A2DP audio session and access Hands-Free or Headset profiles to capture live microphone audio. Firmware 1.0.0.30 reportedly fixes the flaw, but the earbuds cannot be updated through the Skullcandy app, leaving current users without a consumer-accessible patch path.

Cyber Security NewsSep 11, 04:16 UTC · 5d agoVulnerability 2 sources CVE-2025-20701

Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking

CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.

CERT/CC reports the Skullcandy Dime 3 (model S2DCW) running firmware 1.0.0.28 is affected by CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker in close range can pair without user interaction, then hijack audio playback, access the headset profile, and capture live microphone audio. Skullcandy fixed the issue in firmware 1.0.0.30, but existing units have no consumer-accessible update path via the app. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched it for Beats Studio Buds in June.

BleepingComputerSep 9, 21:02 UTC · 7d agoVulnerability CVE-2025-20701

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Researcher disclosed two root RCE chains in Unitree G1 EDU robots (CVE-2026-76639, CVE-2026-76640), one reachable via unpaired Bluetooth, with no confirmed fixed firmware.

Security researcher Olivier Laflamme disclosed two independent root remote code execution chains in the Unitree G1 EDU robot: CVE-2026-76639, a network-adjacent path through chat_go and bashrunner, and CVE-2026-76640, a Bluetooth Low Energy path that ends with a 1,050-byte buffer overflow in btgatt-server giving root on the Locomotion PC. The BLE chain also exploits a cloud authorization gap that let any valid Unitree account recover another robot's AES key, then forces the robot onto an attacker hotspot via wpa_connect.sh heredoc injection. Unitree patched the cloud ownership check in July 2026, but no confirmed fixed firmware release addresses the BLE issues; the PoC was limited to two robots in one room and no in-the-wild exploitation is reported.

The Hacker NewsSep 2, 11:06 UTC · 14d agoVulnerability CVE-2026-76639 CVE-2026-76640

Hack One Robot, Reach the Next: Unitree G1 Security Flaws

Researcher chained two Unitree G1 flaws (CVE-2026-76639, CVE-2026-76640) to gain unauthenticated root access, with compromised robots able to infect others via Bluetooth.

Security researcher Olivier Laflamme chained a path-traversal file-write flaw (CVE-2026-76639) in the G1 chatbot service and a Bluetooth server buffer overflow (CVE-2026-76640) to achieve unauthenticated root access remotely. The chain abuses Unitree's cloud API as a decryption oracle for the AES-128 key that unlocks BLE and WebRTC channels, and a compromised robot can propagate the attack to nearby G1 units. Unitree patched the cloud ownership-check flaw, paid a $5,000 bounty, and firmware fixes for BLE pairing and the buffer overflow remain harder to deliver.

Security AffairsAug 29, 11:55 UTC · 18d agoVulnerability CVE-2026-76639 CVE-2026-76640

USN-8729-1: Linux kernel vulnerabilities

Ubuntu issued USN-8729-1 fixing Linux kernel vulnerabilities across ARM, Bluetooth, GPU, SCSI, SMB, and Azure MANA subsystems.

Ubuntu released USN-8729-1 addressing several security issues discovered in the Linux kernel that could allow an attacker to compromise the system. Fixes span ARM32/ARM64/PowerPC architectures, Bluetooth, GPU, InfiniBand, and network drivers, plus the Microsoft Azure Network Adapter (MANA) driver. The update also corrects flaws in the SCSI and SPI subsystems, SMB and NTFS3 file systems, EFI core, and file systems infrastructure.

Ubuntu Security NoticesSep 7, 09:08 UTC · 9d agoAdvisory 6 sources

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.

The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19774

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm CenterSep 14, 18:33 UTC · 2d agoVulnerability CVE-2022-3437 CVE-2026-20683 CVE-2026-28899+27 CVEs

Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.

Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.

Cyber Security NewsSep 14, 08:01 UTC · 2d agoMalware in the wild1

Hackers infecting Android car systems to build proxy botnet

Kaspersky reports MoYu Group-linked malware infecting DoFun Android car head units, enrolling them in a BadBox-linked proxy botnet for ad fraud and traffic routing.

Kaspersky discovered malware on Android-based head units made by Chinese automotive supplier DoFun, the first documented case of a car head unit being infected through an attack purpose-built for such devices. Attackers abused TWCore, a legitimate DoFun system application that handles updates and can install new apps, to silently push a malicious app called JarService that displays ads, generates fraudulent ad clicks and downloads additional malware. One malware module turns infected head units into reverse proxies so other users' internet traffic can be routed through the car's connection. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BadBox operation, which previously infected over 70,000 Android devices and resurfaced as BadBox 2.0 after German authorities disrupted the original botnet in December 2024.

The RecordAug 24, 12:26 UTC · 23d agoMalware in the wild