cyber.hendryadrian.com
Security Insights · jamf.com

Bluetooth Audio Pairing Flaws Show How Earbuds Can Become Security Risks

· Original article ↗

Summary

Examples including CVE-2025-20701 show how flaws in Bluetooth audio pairing can expose microphones or enable tracking. The article explains the risks and recommends updating accessory firmware and treating earbuds as endpoints.

Key points

  • Apple fixed CVE-2025-20701 in Beats Studio Buds firmware 1B211; Apple described a nearby-attacker risk involving unpaired devices seeking pairing requests.
  • ERNW reported a brief pairing window when Beats Studio Buds power on; an attacker who wins the timing race could establish a bond and reconnect later.
  • The article distinguishes the Beats flaw from WhisperPair, which researchers said affected some accessories with flawed Google Fast Pair implementations.
  • Research on Airoha-based audio devices described risks including unauthorized access to a custom protocol, link-key extraction and device impersonation.
  • Other examples include Stealtooth research on automatic pairing and Apple fixes for headphone and Core Bluetooth issues.
  • The article recommends keeping accessory firmware updated, closing earbuds in their case when not in use, and watching for unexpected pairing prompts or audio changes.

Article Details

Topic
Security risks in Bluetooth audio accessories, including pairing flaws, microphone access, tracking, and firmware updates

CVE

CVE-2022-32945Apple · macOSIn 2022, Apple fixed CVE-2022-32945 and CVE-2022-32946, two Core Bluetooth issues in iOS 16.1 and iPadOS 16. Apple’s advisory says one issue could allow an app to record audio with paired AirPods and the other couldCVE-2022-32946Apple · iOS and iPadOSIn 2022, Apple fixed CVE-2022-32945 and CVE-2022-32946, two Core Bluetooth issues in iOS 16.1 and iPadOS 16. Apple’s advisory says one issue could allow an app to record audio with paired AirPods and the other couldCVE-2024-27867Apple · AirPodsIn 2024, Apple fixed CVE-2024-27867 in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8 and Beats Firmware Update 6F8. The update affected AirPods 2nd generation and later, all AirPods Pro models, AirPods Max,CVE-2025-20700Vendor / Product unavailableCore security impact: CVE-2025-20700, CVE-2025-20701 and CVE-2025-20702 show how chipset-level authentication and authorization flaws can expose custom protocols, link keys, memory access and audio profiles acrossCVE-2025-20701Vendor / Product unavailableA useful reminder of that shift: in June 2026, Apple fixed CVE-2025-20701 in Beats Studio Buds with Beats Firmware Update 1B211. Apple’s advisory described the impact this way: "An attacker within Bluetooth range may beCVE-2025-20702Vendor / Product unavailableCore security impact: CVE-2025-20700, CVE-2025-20701 and CVE-2025-20702 show how chipset-level authentication and authorization flaws can expose custom protocols, link keys, memory access and audio profiles acrossCVE-2025-36911Google · AndroidWhisperPair / CVE-2025-36911

People

Dennis HeinzeCo-authored the MagicPairing research analyzing Apple’s Bluetooth accessory pairing protocol and its implementation vulnerabilities.Felix RohrbachCo-authored the MagicPairing research analyzing Apple’s Bluetooth accessory pairing protocol and its implementation vulnerabilities.Guilherme RamboCredited with the two Core Bluetooth issues CVE-2022-32945 and CVE-2022-32946; his investigation also identified the Siri audio behavior associated with the reported microphone-permission issue.Hiroki KuzunoCo-authored the Stealtooth research on security risks from silent automatic pairing in Bluetooth audio devices.Jiska ClassenCo-authored the MagicPairing research analyzing Apple’s Bluetooth accessory pairing protocol and its implementation vulnerabilities.Jonas DreßlerReported CVE-2024-27867 to Apple and described its potential privacy impact on AirPods.Keiichiro KimuraCo-authored the Stealtooth research on security risks from silent automatic pairing in Bluetooth audio devices.Masakatu MoriiCo-authored the Stealtooth research on security risks from silent automatic pairing in Bluetooth audio devices.Yoshiaki ShiraishiCo-authored the Stealtooth research on security risks from silent automatic pairing in Bluetooth audio devices.

Vendors

Airohamore complicated than one firmware update. Apple referenced CVE-2025-20701, a CVE that also appears in Airoha’s 2025 Bluetooth audio SDK bulletin as a possible way to pair a Bluetooth audio device without userAppleA recent Apple fixGoogleAffected layer: Google Fast Pair accessory implementation

Products

AirPodsAffected layer: AirPods and Beats firmwareAirPods MaxFirmware Update 6F8. The update affected AirPods 2nd generation and later, all AirPods Pro models, AirPods Max, Powerbeats Pro and Beats Fit Pro. Apple described the issue this way: "When your headphones areBeats Studio BudsA useful reminder of that shift: in June 2026, Apple fixed CVE-2025-20701 in Beats Studio Buds with Beats Firmware Update 1B211. Apple’s advisory described the impact this way: "An attacker within Bluetooth range may beGoogle Fast PairAffected layer: Google Fast Pair accessory implementationiOSAffected layer: iOS / iPadOS Core Bluetooth frameworkiPadOSAffected layer: iOS / iPadOS Core Bluetooth framework

Related Articles