CVE ID 2025-20701

nvd.nist.gov • June 17, 2026

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Bluetooth Vulnerability in Beats Earbuds Allows Eavesdropping A serious security vulnerability has been discovered in Apple's Beats Studio Buds, allowing attackers within Bluetooth range to eavesdrop through the device's microphone. The flaw, identified as CVE-2025-20701, is linked to an open-source Airoha Bluetooth Audio SDK used in the earbuds. For exploitation, the earbuds must be unpaired and actively searching for connections. Apple has released firmware version 1B211 to address this issue, which was reported by security researchers Dennis Heinze and Frieder Steinmetz from ERNW GmbH. The vulnerability was known since mid-2025 but was only patched in June 2026. Users are advised to ensure their devices are updated to the latest firmware to mitigate the risk. The vulnerability also affects other earbuds using the same SDK, not just Beats products. 16 sources 72

Extracted Entities

CVE ID 2025-20701

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)