30
30
45
30
30
30
30
30
30
New Pass-ta-key attack reveals all the things we didn't know about passkeys
Ars Technica explains why the new Pass-ta-key attack on passkeys is largely a non-issue, revealing OS differences in passkey apps.
The newly disclosed Pass-ta-key attack against passkeys is assessed as mostly a nothingburger with minimal real-world impact. Ars Technica's analysis details how the attack exposes differences in how passkey apps treat Windows compared to other operating systems. The coverage helps defenders calibrate passkey risk.
30
30
30
30
30
30
30
30
30
30
45
30
30
30
30
30
30
30
30
Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone
CERT/CC disclosed VU#859658: Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing, letting nearby attackers hijack audio and microphone.
Skullcandy Dime 3 wireless earbuds (model S2DCW, firmware 1.0.0.28) accept Bluetooth Classic BR/EDR pairing requests from unknown devices without the owner activating pairing mode, a flaw linked to CVE-2025-20701 in Airoha Bluetooth audio SDK implementations and tracked as VU#859658 by CERT/CC. Attackers within Bluetooth range who know the device address can bond via the NoInputNoOutput configuration, establish A2DP or HFP/HSP connections, disrupt the owner's active audio session, and potentially capture live microphone audio. Firmware 1.0.0.30 addresses the issue, but Dime 3 earbuds do not support firmware updates through the Skullcandy mobile app, leaving affected users without a known upgrade path.
25
VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability
Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.
CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.
24
30
30
30
30
30
30
30
30
30
30