Frieder Steinmetz

A permission bypass exists in the Bluetooth LE GATT service that allows unauthorized access to critical data of the RACE protocol. This issue stems from a lack of authentication for a critical function, which could enable a remote attacker within Bluetooth range to escalate privileges without requiring additional execution privileges or user interaction.

An incorrect authorization flaw in the Airoha Bluetooth audio SDK allows a Bluetooth audio device to be paired without user consent. This issue stems from a lack of authentication for a critical function within the BR/EDR Bluetooth chip component. A proximate attacker within Bluetooth range can exploit this to covertly connect to devices that are not yet paired and are actively seeking pairing requests. This can lead to remote escalation of privilege and enable the attacker to eavesdrop through the device microphone for surveillance without requiring any user interaction or additional execution privileges.

A lack of authentication in the Custom Protocol of Airoha Technology Bluetooth chips allows unauthorized access to the RACE protocol. This flaw enables a remote attacker to bypass security restrictions and achieve remote escalation of privilege without requiring additional execution privileges or user interaction. This issue can be exploited to gain unauthorized access and perform eavesdropping on affected headphones.

The issue arises from the use of insufficiently random values in Auracast, allowing adjacent attackers to access Auracast broadcasting.