Skullcandy Dime 3 Earbuds Exposed to Silent Bluetooth Hijacking via CVE-2025-20701

CERT/CC (VU#859658) warns that Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing (CVE-2025-20701, Airoha Bluetooth Audio SDK), letting nearby attackers hijack audio and capture live microphone audio; a fix exists in…

A CERT/CC vulnerability note (VU#859658) describes a high-severity missing-authentication flaw, CVE-2025-20701, in the Airoha Bluetooth Audio SDK affecting Skullcandy Dime 3 wireless earbuds (model S2DCW, firmware 1.0.0.28). Due to the NoInputNoOutput I/O capability in the Bluetooth Classic (BR/EDR) implementation, an attacker within Bluetooth range who knows the device address can bond without the owner activating pairing mode and without a PIN, passkey, or any user interaction. Once bonded, the attacker's device can automatically reconnect whenever in range, disrupt the owner's active session, hijack the A2DP audio stream, and access Hands-Free (HFP) or Headset (HSP) profiles to capture live microphone audio. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched the same SDK flaw for Beats Studio Buds in June. Skullcandy says firmware 1.0.0.30 addresses the issue, but Dime 3 earbuds do not support firmware updates through the Skullcandy mobile app, leaving existing users without a known consumer-accessible patch path. All three reports agree on these facts with no material discrepancies.

• Vulnerability: CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK, tracked by CERT/CC as VU#859658
• Affected product: Skullcandy Dime 3 earbuds, model S2DCW, firmware 1.0.0.28
• Attack prerequisites: Bluetooth range and knowledge of the device address only — no pairing mode, PIN, passkey, or user interaction required due to NoInputNoOutput configuration
• Impact: attacker can bond over Bluetooth Classic (BR/EDR), auto-reconnect when in range, hijack the A2DP audio session, and use HFP/HSP profiles to capture live microphone audio
• Fix: firmware 1.0.0.30 addresses the flaw, but the earbuds cannot be updated via the Skullcandy mobile app, leaving affected units without a consumer-accessible update path
• The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors
• Apple patched the same Airoha SDK flaw for Beats Studio Buds in June 2026 per BleepingComputer's report