GoKawiilSkullcandy Dime 3 earbuds vulnerable to silent Bluetooth hijacking, no user fix available
CERT/CC disclosed that Skullcandy Dime 3 earbuds running firmware 1.0.0.28 accept Bluetooth pairing from nearby devices without any user approval, due to a flaw in the Airoha Bluetooth Audio SDK tracked as CVE-2025-20701. Skullcandy has released firmware 1.0.0.30 to fix the bug, but there is no way for users to update their earbuds manually or through the companion app.
GoKawiil's interpretation of the reporting above, not reported fact.
Once paired, an attacker's device becomes trusted and can reconnect automatically whenever in range, letting them hijack audio playback or secretly capture microphone audio from the wearer. The underlying SDK flaw affects many other headphone brands beyond Skullcandy, and the lack of a user-accessible firmware update path leaves affected devices exposed indefinitely.
- CVE-2025-20701 lets nearby attackers pair with vulnerable earbuds without a PIN or approval.
- Skullcandy Dime 3 units on firmware 1.0.0.28 are affected; fix exists in 1.0.0.30 but isn't user-installable.
- Other brands using the Airoha SDK, including Apple's Beats Studio Buds, faced the same flaw and have patched it.
Anker Soundcore Life P3 Wireless Earbuds — If the Dime 3's unpatchable pairing flaw has you eyeing a replacement, the Soundcore Life P3 is a solid, widely available swap with active noise cancelling and a companion app that actually pushes firmware updates. It's an easy way to keep true-wireless convenience without being stuck on a version you can't update.
See Anker Soundcore Life P3 Wireless Earbuds on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-09
Published there as: “Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.