Bluetooth SDK Flaw Leaves Skullcandy Earbuds Open to Silent Hijacking
Written by AI from the linked story. Not reviewed by an editor. How this works
A vulnerability in the Airoha Bluetooth Audio SDK (CVE-2025-20701) allows attackers in physical proximity to pair with Skullcandy Dime 3 earbuds without any user interaction, enabling audio hijacking and covert microphone capture. The root issue stems from a third-party SDK embedded in the device firmware that lacked sufficient pairing authentication controls — a classic supply chain risk where a downstream vendor's flaw becomes the end user's exposure. Critically, while Skullcandy issued a patch in firmware 1.0.0.30, the device architecture prevents older firmware from being updated, permanently stranding a portion of users in a vulnerable state. This highlights two compounding failures: inadequate secure update mechanisms in IoT device design, and the absence of a lifecycle policy ensuring all devices can receive security patches. The case underscores why consumers and enterprises must scrutinize the security posture of IoT devices before deployment.
Tactical Insight
Immediate actions
- Update Skullcandy Dime 3 firmware to version 1.0.0.30 immediately if the device supports it, or replace hardware that cannot be patched.
- Avoid using affected earbuds in sensitive environments (meetings, calls handling confidential information) until patched.
- Disable Bluetooth on the device when not actively in use to reduce the attack surface.
Long-term improvements
- Require IoT vendors to demonstrate a secure, over-the-air update capability for all firmware versions as part of procurement criteria.
- Conduct third-party SDK and supply chain security assessments for all IoT hardware before enterprise deployment.
- Establish a device end-of-life and replacement policy that triggers when a device can no longer receive security patches.
Detection measures
- Monitor enterprise Bluetooth environments using RF scanning tools to detect unauthorized pairing attempts or rogue Bluetooth devices.
- Maintain an inventory of all Bluetooth-enabled devices in the organization, including employee peripherals, to enable rapid response to disclosed CVEs.
- Subscribe to CVE and vendor advisory feeds for all hardware SDKs and chipsets used in organizational IoT devices.