[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvljA8iqi2ZpmRunoTzuJso330qTIM2DGZWZ16qiVmBE":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":105},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"90aa7443-02e4-49bd-842f-fa1eddbc4efb","Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking","skullcandy-dime-3-earbuds-expose-users-to-bluetooth-hijacking-39904f","The Carnegie Mellon University CERT Coordination Center (CERT\u002FCC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction. [...]","Skullcandy Dime 3 wireless earbuds are susceptible to Bluetooth hijacking due to a vulnerability in the Airoha Bluetooth Audio SDK (CVE-2025-20701). Attackers can pair with nearby devices without user interaction, allowing them to hijack audio, access the headset profile, and capture microphone audio. While Skullcandy released a fix in firmware version 1.0.0.30, users cannot update older firmware versions, leaving them exposed.","Skullcandy Dime 3 earbuds vulnerable to Bluetooth hijacking due to unauthenticated pairing requests.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fskullcandy-dime-3-earbuds-expose-users-to-bluetooth-hijacking\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F09\u002Fskullcandy.jpg","2026-09-09T21:02:14+00:00","2026-09-09T22:00:53.567969+00:00",7,[17,20,23,26],{"name":18,"type":19},"Skullcandy Dime 3","product",{"name":21,"type":22},"Bluetooth","technology",{"name":24,"type":25},"Skullcandy","vendor",{"name":27,"type":19},"Airoha Bluetooth Audio SDK","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"cve","CVE-2025-20701","Bluetooth hijacking vulnerability in Skullcandy Dime 3 earbuds",[24,18,27],{"controls":53,"vendors":104},[54,83],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[88,96],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":106,"title":107,"body":108,"framework_refs":109,"framework_notes":120},"bluetooth-sdk-flaw-leaves-skullcandy-earbuds-open-to-silent-hijacking","Bluetooth SDK Flaw Leaves Skullcandy Earbuds Open to Silent Hijacking","A vulnerability in the Airoha Bluetooth Audio SDK (CVE-2025-20701) allows attackers in physical proximity to pair with Skullcandy Dime 3 earbuds without any user interaction, enabling audio hijacking and covert microphone capture. The root issue stems from a third-party SDK embedded in the device firmware that lacked sufficient pairing authentication controls — a classic supply chain risk where a downstream vendor's flaw becomes the end user's exposure. Critically, while Skullcandy issued a patch in firmware 1.0.0.30, the device architecture prevents older firmware from being updated, permanently stranding a portion of users in a vulnerable state. This highlights two compounding failures: inadequate secure update mechanisms in IoT device design, and the absence of a lifecycle policy ensuring all devices can receive security patches. The case underscores why consumers and enterprises must scrutinize the security posture of IoT devices before deployment.",[110,111,112,113,114,115,116,117,118,119],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 16 – Application Software Security","NIST SP 800-213 – IoT Device Cybersecurity Guidance","NIST SP 800-40 – Guide to Enterprise Patch Management","NIST SA-12 – Supply Chain Protection","NIST SI-2 – Flaw Remediation","ETSI EN 303 645 – Cyber Security for Consumer IoT (Provision 5.3 – Software Updates)","ISO\u002FIEC 27001 – A.12.6.1 Management of Technical Vulnerabilities","GDPR Article 32 – Security of Processing (where microphone data constitutes personal data)",{}]