CVE-2024-27867

CVE Enrichment

CVSS: 4.3 MEDIUM
EPSS: 0.84%
EPSS Percentile: 58.15%
CISA KEV: Not listed

Description

An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Jun-2024 11:15
Last Modified: 17-Jun-2026 14:20
EPSS Date: 2026-11-07
CWE: CWE-287

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:N /
                            A:N

CNA Products / Version Status

Apple · AirPods Source: CNA · [email protected]
Default status: unknown

0 ≤ version < unknown — affected (custom)

Affected Products / Versions

apple / airpods_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 6a326
cpe:2.3:o:apple:airpods_firmware:*:*:*:*:*:*:*:*
apple / powerbeats_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 6f8
cpe:2.3:o:apple:powerbeats_firmware:*:*:*:*:*:*:*:*
apple / airpods_pro_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 6f8
cpe:2.3:o:apple:airpods_pro_firmware:*:*:*:*:*:*:*:*
apple / beats_fit_pro_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 6f8
cpe:2.3:o:apple:beats_fit_pro_firmware:*:*:*:*:*:*:*:*
apple / airpods_max_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 6f8
cpe:2.3:o:apple:airpods_max_firmware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 07-Nov-2026 23:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

In 2024, Apple fixed CVE-2024-27867 in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8 and Beats Firmware Update 6F8. The update affected AirPods 2nd generation and later, all AirPods Pro models, AirPods Max, Bluetooth Audio Pairing Flaws Show How Earbuds Can Become Security Risks

CVE (6)

People (9)

Vendors (3)

Products (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.