CVE-2025-20701

Name of the Vulnerable Software and Affected Versions Airoha Bluetooth audio SDK (affected versions not specified) Beats Studio Buds versions prior to 1B211

Description An incorrect authorization flaw in the Airoha Bluetooth audio SDK allows a Bluetooth audio device to be paired without user consent. This issue stems from a lack of authentication for a critical function within the BR/EDR Bluetooth chip component. A proximate attacker within Bluetooth range can exploit this to covertly connect to devices that are not yet paired and are actively seeking pairing requests. This can lead to remote escalation of privilege and enable the attacker to eavesdrop through the device microphone for surveillance without requiring any user interaction or additional execution privileges.

Recommendations Update Beats Studio Buds to firmware 1B211. At the moment, there is no information about a newer version that contains a fix for the Airoha Bluetooth audio SDK.