Missing Authentication in Airoha Bluetooth BR/EDR allowing unauthorized audio connection
CVE-2025-20701 is a missing-authentication vulnerability in the Bluetooth Classic (BR/EDR) functionality of Airoha Bluetooth audio SDK / Airoha-based SoCs used in devices including Beats Studio Buds. The flaw allows a nearby attacker to establish an unauthorized Bluetooth Classic connection to a target audio device without user consent or prior pairing. Reported technical details indicate the weakness affects BR/EDR connection handling and can permit unauthorized two-way audio connections, including use of the Hands-Free Profile (HFP). Apple states that, for affected Beats Studio Buds, an attacker within Bluetooth range may be able to listen through the microphone of a device that is not yet paired and is actively seeking pairing requests. The issue has been described by researchers as missing authentication for Bluetooth BR/EDR and as part of the broader 'Headphone Jacking' Airoha vulnerability set.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A missing authentication vulnerability in the Bluetooth BR/EDR radio of Airoha SoCs used in Beats Studio Buds that could allow a nearby attacker to eavesdrop via the microphone of an unpaired device seeking pairing requests.
A high-severity missing authentication vulnerability in the Bluetooth BR/EDR radio of Airoha SoCs affecting Beats Studio Buds, allowing an attacker within Bluetooth range to eavesdrop through the microphone of an unpaired device actively seeking pair requests.
A vulnerability affecting Beats Studio Buds that could allow an attacker within Bluetooth range to listen through the microphone of a device that is not yet paired and is actively seeking pair requests.
A vulnerability in Airoha Bluetooth SoCs (CVSS 8.8) enabling unauthenticated access to the RACE protocol and enabling attack primitives (e.g., arbitrary memory operations) used for nearby device takeover and key extraction/impersonation.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.