Skullcandy Dime 3 Earbuds Allow Unauthenticated Bluetooth Pairing
Summary
CERT/CC warns that Skullcandy Dime 3 earbuds on firmware 1.0.0.28 allow nearby devices to pair without approval, enabling audio and microphone access. Firmware 1.0.0.30 fixes the flaw, but customers cannot currently update existing units themselves.
Key points
- CVE-2025-20701 affects Skullcandy Dime 3 model S2DCW earbuds running firmware 1.0.0.28.
- Nearby devices can pair without user approval, a PIN, or physical access to the earbud case.
- After pairing, an attacker can reconnect automatically, interrupt the owner's connection, hijack audio, and capture live microphone audio.
- Skullcandy says firmware 1.0.0.30 fixes the flaw, but customers currently have no consumer-accessible way to update affected units.
- CERT/CC says the flaw is in the Airoha Bluetooth Audio SDK and affects products from multiple vendors; Airoha published SDK updates on August 4, 2025.
Article Details
- Vulnerability Types
- Missing authentication for Bluetooth pairing
- Severity
- High
- Affected Versions
- Skullcandy Dime 3 firmware 1.0.0.28
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
MITRE ATT&CK
CVE
People
Vendors
AirohaThe flaw, tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK, was fixed in firmware 1.0.0.30, but existing customers currently have no consumer-accessible way to update affected units.AppleApple addressed the flaw for its Beats Studio Buds via a firmware update released this June.SkullcandyCERT/CC warns that Skullcandy Dime 3 earbuds running firmware 1.0.0.28 accept Bluetooth pairing from nearby unpaired devices without user interaction, exposing users to rogue device access and audio hijacking.
Products
Airoha Bluetooth Audio SDKThe flaw, tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK, was fixed in firmware 1.0.0.30, but existing customers currently have no consumer-accessible way to update affected units.Beats Studio BudsApple addressed the flaw for its Beats Studio Buds via a firmware update released this June.Skullcandy Dime 3CERT/CC warns that Skullcandy Dime 3 earbuds running firmware 1.0.0.28 accept Bluetooth pairing from nearby unpaired devices without user interaction, exposing users to rogue device access and audio hijacking.