Skullcandy Dime 3 earbuds allow silent Bluetooth pairing

Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthorized Bluetooth pairing without user consent, letting nearby attackers hijack audio or capture microphone data.

CERT/CC has published an advisory detailing a Bluetooth Classic (BR/EDR) pairing vulnerability affecting Skullcandy Dime 3 (Model S2DCW) wireless earbuds running firmware 1.0.0.28. The earbuds use an Airoha Technology Corp. Bluetooth chipset and accept new pairing requests from unpaired devices without requiring pairing mode activation, a PIN/passkey, or any physical confirmation from the owner, due to a NoInputNoOutput I/O capability configuration. This issue was previously disclosed as CVE-2025-20701 in the underlying Airoha Bluetooth audio SDK.

An attacker within Bluetooth radio range can send a direct pairing request to the earbuds' known or discoverable address and complete bonding without any owner interaction. Once paired, the attacker's device is trusted and can auto-reconnect whenever in range, allowing it to hijack the A2DP audio transport (interrupting the legitimate user's connection) or leverage the Hands-Free/Headset profile to capture live microphone audio. The only indication to the victim is an audible "New device paired" notification that occurs after the fact, giving no opportunity to prevent the takeover.

While the vendor considers the CVE-2025-20701 fix in firmware 1.0.0.30 effective, Skullcandy has confirmed the Dime 3 does not support firmware updates via its companion app, meaning affected units in the field currently have no consumer-accessible remediation path. Defenders and consumers should be aware that physical proximity is the only barrier to exploitation, and no mitigations beyond hardware replacement or vendor-provided updates are currently available.

Source reporting: https://kb.cert.org/vuls/id/859658