CVE-2025-20702

Think of a Bluetooth device like a building with locked doors and internal “service” rules. This bug may let someone bypass those internal rules for the device’s RACE protocol, effectively upgrading their access level inside the device. The concerning part is that an attacker may be able to do this remotely, without needing extra capabilities or user actions from you.

This matters to you if your company uses or sells devices built with the Airoha Bluetooth audio SDK, especially products using the Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series, or AB1627. It’s not described as something that affects general desktop or office software; it’s tied to specific Bluetooth audio SDK/device lines from Airoha. If you don’t use these specific device lines, you may not be affected, but you should confirm with your hardware vendor.

This is an AMBER-level issue: it’s high impact and remote, but the situation is not fully “confirmed weaponized” in public. There is a proof-of-concept reported (“poc_public”), but there’s no known public exploit, no CISA KEV entry, and no Nuclei detection template, which suggests attackers may still be limited or evolving. Because it’s a patch-related resurfacing and the flaw can be triggered remotely without user interaction, you should prioritize updates in the near term.