Home / Technology / Unpatchable Flaw Found in Skullcandy Earbuds
Unpatchable Flaw Found in Skullcandy Earbuds
15 Sep
Summary
- Skullcandy Dime 3 earbuds allow unknown Bluetooth pairings without user confirmation.
- A new firmware fixes newer units, but existing earbuds remain vulnerable.
- The vulnerability stems from an Airoha chipset, first disclosed in mid-2025.
Carnegie Mellon University's CERT Coordination Center has issued a warning regarding a significant Bluetooth vulnerability affecting Skullcandy Dime 3 wireless earbuds. These earbuds, when running older firmware, can accept pairing requests from unknown devices without any user consent or interaction. Once paired, this connection is permanent and can be exploited to disrupt connections, hijack audio playback, or even capture live microphone audio.
The vulnerability, identified as CVE-2025-20701, originates from an Airoha Bluetooth chipset. While Airoha provided a Software Development Kit (SDK) fix in August 2025, Skullcandy has only addressed the issue in newly manufactured units with firmware version 1.0.0.30. Unfortunately, existing earbuds cannot be updated via Skullcandy's companion app, leaving owners with an unpatchable security flaw.
This situation highlights a critical gap in security updates for some consumer electronics. Unlike Apple, which can push firmware updates to its Beats Studio Buds, Skullcandy's budget earbuds lack this capability for existing users. The severity of the vulnerability has been debated, with MediaTek assigning it a moderate score, while CISA categorized it as high. The exploitation, though limited to the earbuds' capabilities, could still pose significant risks to users.
