237/68 Tuesday, July 1, 2025
Cybersecurity researchers have disclosed critical vulnerabilities in Airoha Bluetooth chipsets used in over 29 popular audio devices from 10 leading manufacturers, including Beyerdynamic, Bose, Sony, Marshall, Jabra, and JBL. These vulnerabilities could allow attackers to eavesdrop on conversations or even steal sensitive user data. The affected devices include wireless speakers, headphones, and microphones, making everyday gadgets potentially vulnerable. While the attacks require a high level of technical expertise and physical proximity to the target, the potential to take control of the devices and access private data such as call histories and contact lists is deeply concerning.
The three vulnerabilities identified are CVE-2025-20700 and CVE-2025-20701 (both rated as medium severity), and CVE-2025-20702 (rated high severity). Researchers from ERNW demonstrated how these flaws could allow attackers to read media content being played on targeted headphones. Additionally, they showed that the vulnerabilities could be exploited to hijack Bluetooth connections between mobile phones and Bluetooth devices and send unauthorized commands via the Bluetooth Hands-Free Profile (HFP). This includes making unauthorized phone calls and even listening in on conversations or ambient sounds near the phone. Alarmingly, the researchers also noted the possibility of rewriting the firmware of affected devices to enable remote code execution, potentially allowing malware to spread to other devices.
While the attack scenarios are alarming, there are limitations to such exploits. Widespread attacks are unlikely due to the need for close proximity and sophisticated technical skills. As a result, these attacks are more likely to target high-value individuals, such as diplomats, journalists, or activists. Airoha, the chipset manufacturer, has already released an updated SDK to address the vulnerabilities, and device manufacturers are currently developing and rolling out firmware patches. However, reports indicate that more than half of the affected devices are still running older firmware versions—those released before Airoha delivered the updated SDK to clients. Therefore, users are strongly advised to closely monitor firmware updates from their device manufacturers to mitigate potential risks.
