Bluetooth vulnerability in Skullcandy Dime 3 earbuds exposes users to audio interception

A flaw in Skullcandy’s Dime 3 wireless earbuds allows nearby attackers to establish unauthorised connections, risking audio eavesdropping and microphone access. Although a firmware fix exists, many owners remain vulnerable due to limited update options.

CERT/CC has warned that Skullcandy’s Dime 3 wireless earbuds can be paired by a nearby attacker without any confirmation from the owner, creating a route to audio interception and microphone access. The flaw affects units running firmware version 1.0.0.28 and is tracked as CVE-2025-20701, according to the advisory and reporting by multiple security outlets.

The issue lies in the Airoha Bluetooth Audio SDK used by the earbuds for wireless connectivity. According to CERT/CC, an attacker only needs to be within Bluetooth range to establish a connection; no PIN, case access or approval prompt is required. Although the owner may hear a pairing alert, the warning can be easy to miss and may resemble a brief connection drop rather than a hostile takeover.

Once a malicious device is paired, it can be treated as trusted and reconnect automatically when it comes back into range. That behaviour can let an attacker interrupt the owner’s listening session, redirect audio playback and access the microphone stream in real time, according to the advisory. Security researchers from ERNW first disclosed the underlying flaw at TROOPERS last year, and the same weakness has since been linked to a wide range of Bluetooth audio products from several brands.

A fix exists in firmware version 1.0.0.30, and Skullcandy says the problem has been addressed there. The difficulty is that owners of vulnerable Dime 3 units cannot install the update through the Skullcandy app or by any known manual method, leaving earlier purchases exposed even though newer production runs may ship with the patched software. CERT/CC said it learned of the issue after a report from independent researcher Jacob Nowak.