CVE-2025-20701

No known exploitation. EPSS puts it in the 95th percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile95th8.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2025-08-04Updated 2026-09-08Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x seriesAffected: Airoha IoT SDK for BT audio v5.5.0 and earlierUpgrade to: not statedAffected: Airoha AB1561x/AB1562x/AB1563x SDK v3.3.1 and earlierUpgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Contact your device/vendor/IT team and ask specifically for an update or patched firmware for Airoha Technology Corp. AB156x/AB157x/AB158x/AB159x series-based Bluetooth audio components addressing CVE-2025-20701.
If you control the firmware build, ensure the Airoha Bluetooth audio SDK and any Bluetooth pairing-related code/config are updated to the vendor’s fixed version.
Reduce Bluetooth exposure where practical (for example, limit who/what devices can connect, and disable Bluetooth pairing/discovery if your product allows it until patched).

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

4 publishers

CERT/CC warned that Skullcandy Dime 3 headphones lack authentication for Bluetooth pairing, allowing nearby attackers to intercept audio and access microphones.
as reported · Sep 14, 2026·Хакер (xakep.ru) summary
Vendor patch released
as reported · Jun 19, 2026·Хакер (xakep.ru) summary

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In plain language

Written by AI from the record

CVE-2025-20701 is a high-impact Bluetooth pairing flaw in Airoha’s Bluetooth audio SDK that may allow an attacker to pair a device without your approval and potentially gain higher control—AMBER means you should act, but it’s not an emergency for every small business today.

What is it

Normally, when you connect Bluetooth audio (like headphones or a speaker), the device you’re connecting to should ask for your consent. This vulnerability describes a possible way to pair a Bluetooth audio device without that consent. An attacker might be able to raise their level of control remotely—without needing to trick you into clicking anything.

Who is affected

This matters to you if your business uses products based on Airoha Technology Corp. AB156x, AB157x, AB158x, or AB159x series that rely on the Airoha Bluetooth audio SDK for Bluetooth audio pairing. It also matters if you manage or ship devices using Сообщество свободного программного обеспечения Airoha Technology’s Bluetooth audio components. If you only use off-the-shelf consumer Bluetooth devices and you are not running or customizing Airoha-based firmware, your direct exposure is less likely—but you should still ask the vendor about patch status.

How urgent is it

Because the issue involves remote device control steps and the problem is described as potentially leading to escalation of privilege, you should prioritize a fix. Even though there is no public exploit and CISA KEV does not list it, press reports indicate a proof-of-concept exists, and exploitation may become more common as patches spread. Treat this as AMBER: plan and complete remediation soon (days to 1–2 weeks), rather than waiting until it becomes a crisis.

What to do — in detail

Identify where Airoha Bluetooth audio SDK is used: determine whether your deployed devices are built on Airoha Technology Corp. AB156x, AB157x, AB158x, or AB159x series, and whether the affected Bluetooth audio pairing functionality is enabled.
Get the fix from the vendor: ask for the official Airoha SDK/firmware update that remediates CVE-2025-20701. If you build firmware yourself, pull the patched Airoha Bluetooth audio SDK version and integrate it into your product’s Bluetooth stack.
Patch or replace:
- If patchable: upgrade the firmware/SDK in your devices to the vendor’s fixed release.
- If not patchable: plan a hardware/software replacement and/or compensating controls (see step 5).
Validate after updating:
- Confirm Bluetooth audio pairing behaves as expected (requires user consent/authorization per normal product behavior).
- Check logs/telemetry (if available) for unexpected pairing events or repeated pairing attempts.
Compensating mitigations while waiting for the patch:
- Disable or restrict Bluetooth pairing and discovery features when not needed.
- Limit Bluetooth device connectivity to approved devices only (where your product supports allowlists/paired-device-only modes).
- Reduce the set of environments where devices have Bluetooth exposure (for example, don’t leave pairing mode enabled overnight).
Monitor and follow up:
- Watch vendor advisories for additional details about exploitation and fixed versions.
- After rollout, re-check that device firmware versions match the patched baseline for the AB156x/AB157x/AB158x/AB159x series.
Security communication: document the remediation steps, firmware versions deployed, and the date you applied the fix for internal records and for any customer/vendor reporting needs.

Technical context

Severity is described as high (reported CVSS 8.8). The issue is a Bluetooth audio pairing authorization weakness in the Airoha Bluetooth audio SDK: it is possible to pair a Bluetooth audio device without user consent, and this could enable remote escalation of privilege without needing additional execution privileges. The provided context indicates exploitation status as "poc_public" and that no known CISA KEV entry exists; public exploit availability is noted as "no" and there is no Nuclei detection template. EPSS is 4.3% estimated probability of exploitation in the next 30 days, which suggests a non-trivial chance but not certainty. In practice, this means attackers may not have a widely automated public tool yet, but proof-of-concept knowledge exists and the pairing-related attack path could be adapted. For defenders, prioritize patching the Bluetooth pairing/consent handling in Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series deployments and verify that user consent (or equivalent authorization) is enforced for pairing events.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

8.0% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 400 days, from the signal feeds we watch.

2026-09-08Patch availablerecord updated
2026-08-06Patch availablerecord updated
2026-06-21Patch availablerecord updated
2025-08-04Publishedweakness classified, att&ck mapped

Affected products

Airoha Technology Corp.commercial · TW
- AB156x, AB157x, AB158x, AB159x seriesEmbeddedHardware Firmware / cpu-gpu
Сообщество свободного программного обеспеченияoss-projectaka fsf
- Airoha TechnologyHardware Firmware / network-adapter

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector AdjacentRequires access to the local network (e.g. same Wi-Fi, Bluetooth)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable