cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Apple Patches Bluetooth Eavesdropping Flaw in Beats Studio Buds

· Original article ↗

Summary

Apple’s Beats Firmware Update 1B211 patches CVE-2025-20701, which could let a nearby attacker listen through an unpaired Beats Studio Buds microphone. Researchers say chaining related flaws could enable broader device control.

Key points

  • Apple patched CVE-2025-20701 in Beats Studio Buds with firmware update 1B211.
  • The flaw could let an attacker within Bluetooth range listen through the microphone of a device that is not paired and is seeking pair requests.
  • ERNW researchers attributed the flaw to a missing authentication weakness in the Bluetooth BR/EDR radio of Airoha SoCs.
  • Researchers demonstrated proof-of-concept call initiation and eavesdropping, and said related flaws CVE-2025-20700 and CVE-2025-20702 could enable broader device control.
  • Apple says the update is delivered automatically when vulnerable earbuds are paired and within Bluetooth range of an iPhone, iPad, or Mac.

Article Details

Vulnerability Types
  • Missing authentication in the Bluetooth BR/EDR radio
Severity
High
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1123 · Audio CaptureThe researchers' proof of concept could initiate a call and use the targeted phone's microphone to eavesdrop on conversations.

CVE

CVE-2025-20700Vendor / Product unavailableThe issue affects the Airoha SoC and was disclosed by ERNW researchers Dennis Heinze and Frieder Steinmetz, with related vulnerabilities CVE-2025-20700 and CVE-2025-20702 also enabling deeper device compromise.CVE-2025-20701Vendor / Product unavailableApple has released Beats Firmware Update 1B211 to fix CVE-2025-20701, a high-severity Bluetooth flaw in Beats Studio Buds that could let nearby attackers eavesdrop on conversations.CVE-2025-20702Vendor / Product unavailableThe issue affects the Airoha SoC and was disclosed by ERNW researchers Dennis Heinze and Frieder Steinmetz, with related vulnerabilities CVE-2025-20700 and CVE-2025-20702 also enabling deeper device compromise.

People

Dennis HeinzeERNW researcher who discovered the vulnerability and participated in demonstrating proof-of-concept attacks.Frieder SteinmetzERNW researcher who discovered the vulnerability and participated in demonstrating proof-of-concept attacks.

Vendors

AirohaThe issue affects the Airoha SoC and was disclosed by ERNW researchers Dennis Heinze and Frieder Steinmetz, with related vulnerabilities CVE-2025-20700 and CVE-2025-20702 also enabling deeper device compromise.AppleApple has released Beats Firmware Update 1B211 to fix CVE-2025-20701, a high-severity Bluetooth flaw in Beats Studio Buds that could let nearby attackers eavesdrop on conversations.

Products

Beats Studio BudsApple has released Beats Firmware Update 1B211 to fix CVE-2025-20701, a high-severity Bluetooth flaw in Beats Studio Buds that could let nearby attackers eavesdrop on conversations.

Related Articles