Airoha Bluetooth Chip Flaws (CVE-2025-20700, 20701, 20702): Which Headphones Are at Risk and What to Do

Key takeaways

• The CVEs are CVE-2025-20700 (missing authentication for GATT), CVE-2025-20701 (missing authentication for BR/EDR) and CVE-2025-20702 (critical capabilities in a custom protocol).
• ERNW researchers presented the work at TROOPERS 25. Check their write-up for the device list.
• The attacker must be in Bluetooth range and needs strong technical skill, so mass exploitation is unlikely.
• Fixes come as firmware from headphone makers, not from phone updates alone.
• Update the headphone app, unpair unused devices and be careful with sensitive calls around unknown people.

What are the Airoha Bluetooth vulnerabilities?

Airoha makes Bluetooth chips used in many true wireless earbuds, headphones and speakers. Researchers at ERNW found three issues in the way some devices using Airoha chips handle connections and a custom management protocol. The CVE identifiers are:

Look up each on the National Vulnerability Database for the official score and vendor references. The earlier version of this page quoted individual scores and a count of affected products, and we could not verify the figures against the primary sources, so use ERNW write-up and NVD for them.

How could an attack work?

In outline, as described by the researchers:

1. The attacker is within Bluetooth range of a vulnerable device, in practice within a few metres.
2. Because the device does not require authentication on some interfaces, the attacker can connect without pairing.
3. The attacker can read or write data on the headset, and with the custom protocol flaw, may extract information such as pairing keys.
4. With those keys, the attacker could impersonate the headset towards the paired phone, and issue commands such as starting a call or listening through the phone.

This was shown as research with proof of concept work. It needs time, the right hardware and detailed knowledge, and the target must be a vulnerable model. We do not describe the attack steps further. Nobody should test these on devices they do not own, and the IT Act treats unauthorised access as an offence.

Who is at risk?

People who handle sensitive calls near others, such as journalists, executives and officials, face the most realistic risk. For most listeners, the risk is low but not zero. Whether your model is affected depends on whether it uses an affected Airoha chip and firmware, so look for your brand in the researchers' list and the maker's advisory.

What can you do now?

• Check the maker's site and app for firmware updates and install them.
• Unpair and delete old Bluetooth devices from your phone.
• Turn Bluetooth off in crowded places when you do not need it.
• Move sensitive calls to a wired headset or a private place if you think your model is vulnerable and unpatched.
• Keep your phone updated.

Why does Bluetooth keep having bugs like this?

Bluetooth has many layers (classic, Low Energy, vendor protocols) and each device maker builds on a chip vendor SDK. Updates depend on the manufacturer, and cheap accessories are often never updated. Related reading: the PerfektBlue Bluetooth vulnerability in vehicles, Ubertooth One for Bluetooth security testing in an authorised lab, and a Dell patching example for how coordinated fixes work.

Checklist for IT teams

1. List which headsets are used by staff in sensitive roles.
2. Prefer models with a clear update policy.
3. Add Bluetooth device hygiene to the security awareness training.

Next steps

Next steps: to learn wireless attack and defence legally, see our CEH v13 AI course, and read about PerfektBlue in vehicles.