Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published Updated

Skullcandy's Dime 3 earbuds pair silently with any Bluetooth device in range

CERT/CC says the Airoha SDK flaw CVE-2025-20701 was fixed upstream on August 4, 2025 and in Skullcandy firmware 1.0.0.30, but units already sold on 1.0.0.28 have no update path, so the fix only reaches new stock.

The Watch · Security desk

Send a correction

Illustration accompanying Skullcandy's Dime 3 earbuds pair silently with any Bluetooth device in range
Generated illustration

What happened

  • CERT/CC says Skullcandy Dime 3 earbuds accept Bluetooth pairing from an unpaired device in close range with no PIN, no access to the charging case and no approval from the owner.
  • Once bonded, the attacker's device is trusted and reconnects automatically, letting it cut the owner's connection, hijack playback, use the headset profile and capture live microphone audio.
  • The flaw is CVE-2025-20701 in the Airoha Bluetooth Audio SDK, which the Dime 3 (model S2DCW) uses for wireless connectivity, and firmware 1.0.0.28 is the affected build.
  • Skullcandy's fix landed in firmware 1.0.0.30, but CERT/CC found no consumer-accessible method to move an existing unit off 1.0.0.28, whether by hand or through the app.

Why it matters

  • Who's exposed exposure The reachable asset is a live microphone, so the people exposed include anyone talking near the wearer, not only the person who bought the earbuds.
  • Who has to decide decision An owner on 1.0.0.28 is choosing between buying replacement hardware and accepting an open pairing surface, because the advisory offers no software route out.
  • What it limits constraint The advisory is written for consumers and offers no fleet or workplace guidance, so anyone responsible for room privacy has nothing to enumerate a building against.
  • What it sets up precedent This case shows the split runs on whether a vendor built a firmware channel to the product before it needed one, not on how the flaw was diagnosed.

Pairing is the entire attack. A radio in range asks, and a Dime 3 on firmware 1.0.0.28 answers yes without a PIN, without access to the charging case, and without a prompt on the owner's phone [2]. The bond then sticks. The attacker's device is trusted from that point and reconnects on its own whenever it comes back into range, which is what turns a proximity trick into standing access to the headset profile and live microphone audio [5].

Skullcandy's fix exists. It is firmware 1.0.0.30 [6], and it reaches units that ship with it. CERT/CC's advisory is explicit about the rest: "As of this writing, there are no known consumer-accessible methods to update an existing unit from the affected firmware version 1.0.0.28 to version 1.0.0.30" [7]. For a pair already in someone's pocket, that leaves replacement or leaving them powered off as the only controls [15].

Airoha published SDK updates on August 4, 2025, and earbud manufacturers took them up afterwards [8]. The underlying defect is a missing-authentication problem that affects earbud and headphone products from multiple vendors, not just this model [4]; ERNW researchers found it and presented it at the TROOPER conference last year [9]. Apple shipped a firmware update for its Beats Studio Buds in June [10]. The defect traces to the same SDK across vendors; what separates a closed case from an open one is firmware delivery, not diagnosis [16].

The wearer's only cue is a "new device paired" notification after the rogue bond is already made, which CERT/CC expects to be missed or read as a brief dropout and reconnection [12]. CERT/CC picked up the Skullcandy case from a tip by researcher Jacob Nowak [11]. Neither the advisory nor the coverage puts a number on how many Dime 3 units are in circulation on 1.0.0.28; the product sits at the cheap end of the market and, per BleepingComputer, is popular with young buyers [14]. Skullcandy has not accounted publicly for the gap, and BleepingComputer reported it could not reach the company because its chatbot does not handle press requests [13].

That is the whole evidence base. It is a consumer advisory. It carries no serial-number or date-code mapping, so an owner holding a Dime 3 cannot tell from the box which firmware is inside. Until a service or app path for 1.0.0.28 appears, the controls available are physical: distance and the power state of the earbuds.

What to watch

  • Whether Skullcandy publishes a service or app path that moves an existing unit from 1.0.0.28 to 1.0.0.30.
  • Whether CERT/CC names further vendors still shipping unpatched Airoha Bluetooth Audio SDK firmware.
  • Whether a public proof-of-concept for CVE-2025-20701 appears, which would move this from close-range research to opportunistic use.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption10
Hype gap+5
Incentives
Not scored
Confidence62
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction.

    Reported SupportedView cited source
  2. [2]

    An attacker in close range of a vulnerable device can connect over Bluetooth without a pairing PIN, physical access to the earbuds case, or an approving pairing request.

    Reported SupportedView cited source
  3. [3]

    Devices running firmware version 1.0.0.28 are affected by a high-severity vulnerability tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK, which the Skullcandy Dime 3 (model S2DCW) uses to handle wireless connectivity between the earbuds and connected devices.

    Reported SupportedView cited source
  4. [4]

    CVE-2025-20701 is a high-severity missing-authentication problem that affects a broad range of earbud and headphone products from multiple vendors.

    Reported SupportedView cited source
  5. [5]

    After pairing, the attacker's device becomes trusted and can automatically reconnect when nearby, enabling them to interrupt the owner's connection, hijack audio playback, access the headset profile, and capture live microphone audio.

    Reported SupportedView cited source
  6. [6]

    Skullcandy says the security issue was fixed in firmware version 1.0.0.30.

    Reported SupportedView cited source
  7. [7]

    CERT/CC states that existing units running the vulnerable firmware cannot currently be updated by customers through the app, and that as of the advisory there are no known consumer-accessible methods to update an existing unit from firmware 1.0.0.28 to 1.0.0.30.

    Reported SupportedView cited source
  8. [8]

    Airoha published SDK updates to address the issue on August 4, 2025, and earbud manufacturers subsequently adopted the fixes.

    Reported SupportedView cited source
  9. [9]

    CVE-2025-20701 was discovered by ERNW researchers and presented at the TROOPER cybersecurity conference last year.

    Reported SupportedView cited source
  10. [10]

    Apple addressed the flaw for its Beats Studio Buds via a firmware update released this June.

    Reported SupportedView cited source
  11. [11]

    After receiving a tip from researcher Jacob Nowak, CERT/CC found that CVE-2025-20701 impacts the Skullcandy Dime 3 running firmware version 1.0.0.28.

    Reported SupportedView cited source
  12. [12]

    The target may hear a "new device paired" notification after the rogue pairing has taken place, but this is easy to miss or dismiss as a momentary connection loss followed by a reconnection.

    Reported SupportedView cited source
  13. [13]

    BleepingComputer said it has been unable to contact Skullcandy about Dime 3 users' inability to upgrade to a safe firmware version, because the company's chatbot does not handle press requests.

    Reported SupportedView cited source
  14. [14]

    The Skullcandy Dime 3 is an affordable wireless Bluetooth earbud that is very popular with young users looking for bass-heavy sound tuning and long battery life.

    Reported SupportedView cited source
  15. [15]

    Because the fix exists only in firmware 1.0.0.30 and no consumer-accessible path exists from 1.0.0.28, remediation for a unit already in an owner's hands is replacement or non-use.

    Derived Supported
  16. [16]

    The same Airoha SDK defect is closed on Beats Studio Buds, which received a firmware update, and open on Dime 3 units on 1.0.0.28, which have no consumer update path, so the difference between vendors is firmware delivery capability.

    Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 9, 2026

    Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking
  2. scworld.com

    1 article · September 10, 2026

    Skullcandy Dime 3 earbuds vulnerable to Bluetooth hijacking

Topics and entities

Topics

  • Bluetooth Security
  • Third-party component vulnerabilities
  • Firmware Update Delivery

Entities