Frieder Steinmetz

**Name of the Vulnerable Software and Affected Versions** Airoha Bluetooth audio SDK (affected versions not specified) **Description** A permission bypass exists in the Bluetooth LE GATT service that allows unauthorized access to critical data of the RACE protocol. This issue stems from a lack of authentication for a critical function, which could enable a remote attacker within Bluetooth range to escalate privileges without requiring additional execution privileges or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Airoha Bluetooth audio SDK (affected versions not specified) Beats Studio Buds versions prior to 1B211 **Description** An incorrect authorization flaw in the Airoha Bluetooth audio SDK allows a Bluetooth audio device to be paired without user consent. This issue stems from a lack of authentication for a critical function within the BR/EDR Bluetooth chip component. A proximate attacker within Bluetooth range can exploit this to covertly connect to devices that are not yet paired and are actively seeking pairing requests. This can lead to remote escalation of privilege and enable the attacker to eavesdrop through the device microphone for surveillance without requiring any user interaction or additional execution privileges. **Recommendations** Update Beats Studio Buds to firmware 1B211. At the moment, there is no information about a newer version that contains a fix for the Airoha Bluetooth audio SDK.

**Name of the Vulnerable Software and Affected Versions** Airoha Bluetooth audio SDK (affected versions not specified) **Description** A lack of authentication in the Custom Protocol of Airoha Technology Bluetooth chips allows unauthorized access to the RACE protocol. This flaw enables a remote attacker to bypass security restrictions and achieve remote escalation of privilege without requiring additional execution privileges or user interaction. This issue can be exploited to gain unauthorized access and perform eavesdropping on affected headphones. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Auracast versions prior to SMR Mar-2025 Release 1 **Description** The issue arises from the use of insufficiently random values in Auracast, allowing adjacent attackers to access Auracast broadcasting. **Recommendations** For versions prior to SMR Mar-2025 Release 1, update to SMR Mar-2025 Release 1 or later to resolve the issue.