Skullcandy Dime 3 earbuds allow silent Bluetooth pairing
Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthorized Bluetooth pairing without user consent, letting nearby attackers hijack audio or capture microphone data.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has published an advisory detailing a Bluetooth Classic (BR/EDR) pairing vulnerability affecting Skullcandy Dime 3 (Model S2DCW) wireless earbuds running firmware 1.0.0.28. The earbuds use an Airoha Technology Corp. Bluetooth chipset and accept new pairing requests from unpaired devices without requiring pairing mode activation, a PIN/passkey, or any physical confirmation from the owner, due to a NoInputNoOutput I/O capability configuration. This issue was previously disclosed as CVE-2025-20701 in the underlying Airoha Bluetooth audio SDK.
An attacker within Bluetooth radio range can send a direct pairing request to the earbuds' known or discoverable address and complete bonding without any owner interaction. Once paired, the attacker's device is trusted and can auto-reconnect whenever in range, allowing it to hijack the A2DP audio transport (interrupting the legitimate user's connection) or leverage the Hands-Free/Headset profile to capture live microphone audio. The only indication to the victim is an audible "New device paired" notification that occurs after the fact, giving no opportunity to prevent the takeover.
While the vendor considers the CVE-2025-20701 fix in firmware 1.0.0.30 effective, Skullcandy has confirmed the Dime 3 does not support firmware updates via its companion app, meaning affected units in the field currently have no consumer-accessible remediation path. Defenders and consumers should be aware that physical proximity is the only barrier to exploitation, and no mitigations beyond hardware replacement or vendor-provided updates are currently available.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/859658
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs