{"vulnerability": "CVE-2025-2070", "sightings": [{"uuid": "6bc1bc1a-3f7b-4d08-834a-d976ec74e8d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mbewknvngh26", "content": "", "creation_timestamp": "2026-01-01T17:43:26.504281Z"}, {"uuid": "8317a6b6-b8f8-4110-a176-1a6d1ab28e63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mbewknvngh26", "content": "", "creation_timestamp": "2026-01-01T17:43:26.590692Z"}, {"uuid": "cbd25373-1ee1-4a9f-adcc-060464b2f3bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mbewknvngh26", "content": "", "creation_timestamp": "2026-01-01T17:43:26.668188Z"}, {"uuid": "7120d61d-3cf7-438c-a7b8-f16a0b38b0d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/lowk3y.bsky.social/post/3mbphthybzo27", "content": "", "creation_timestamp": "2026-01-05T22:19:13.486423Z"}, {"uuid": "b8c454ed-ff69-4d16-be9c-834f5c90610b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://bsky.app/profile/lowk3y.bsky.social/post/3mbphthybzo27", "content": "", "creation_timestamp": "2026-01-05T22:19:13.592738Z"}, {"uuid": "b19bded7-5134-48e1-9df4-379e530f5147", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://bsky.app/profile/lowk3y.bsky.social/post/3mbphthybzo27", "content": "", "creation_timestamp": "2026-01-05T22:19:13.666779Z"}, {"uuid": "117ee27c-88a9-4792-887a-0eb04993789b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/0xor0ne.bsky.social/post/3mc5hm7hejk2q", "content": "", "creation_timestamp": "2026-01-11T11:52:28.549783Z"}, {"uuid": "7eef29fd-1c92-4481-8976-975999f1361f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqgyctmzk2p", "content": "", "creation_timestamp": "2026-01-19T01:01:54.961137Z"}, {"uuid": "21e24691-7c58-4941-9d73-1f934c3831d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqgyctmzk2p", "content": "", "creation_timestamp": "2026-01-19T01:01:55.058444Z"}, {"uuid": "f3f339fe-3f7b-4872-a505-5a0b06adbdc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqgyctmzk2p", "content": "", "creation_timestamp": "2026-01-19T01:01:55.129016Z"}, {"uuid": "013e9294-bc47-4db6-9869-c1279693b790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqhcvivyk2p", "content": "", "creation_timestamp": "2026-01-19T01:07:49.806894Z"}, {"uuid": "1675171f-b490-4218-9d99-875ff7ea5127", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqhcvivyk2p", "content": "", "creation_timestamp": "2026-01-19T01:07:49.882116Z"}, {"uuid": "98eb91e8-350b-4608-a234-caf10513c7d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqhcvivyk2p", "content": "", "creation_timestamp": "2026-01-19T01:07:49.961630Z"}, {"uuid": "9742896f-b63d-4227-934c-4a0b5cf9cf7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/hjmscs4.bsky.social/post/3mcqjigslxc2p", "content": "", "creation_timestamp": "2026-01-19T01:46:42.644889Z"}, {"uuid": "667fde60-af4b-4cfb-bba3-9f4b826704fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mct45zzhev23", "content": "", "creation_timestamp": "2026-01-20T02:26:13.742968Z"}, {"uuid": "c7d0345a-cc84-4bbb-8aee-46b2e979986d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "published-proof-of-concept", "source": "https://t.me/CyberBulletin/3544", "content": "\u26a1\ufe0fBluetooth flaws could let hackers spy through your microphone\n\nVulnerabilities affecting a Bluetooth chipset present in more than two dozen audio devices from ten vendors can be exploited for eavesdropping or stealing sensitive information.\n\nResearchers confirmed that 29 devices from Beyerdynamic, Bose, Sony, Marshall, Jabra, JBL, Jlab, EarisMax, MoerLabs, and Teufel are affected.\n\nThe list of impacted products includes speakers, earbuds, headphones, and wireless microphones.\n\nThe security problems could be leveraged to take over a vulnerable product and on some phones, an attacker within connection range may be able to extract call history and contacts.\n\nSnooping over a Bluetooth connection\nAt the TROOPERS security conference in Germany, researchers at cybersecurity company ERNW disclosed three vulnerabilities in the Airoha systems on a chip (SoCs), which are widely used in True Wireless Stereo (TWS) earbuds.\n\nThe issues are not critical and besides close physical proximity (Bluetooth range), their exploitation also requires \u201ca high technical skill set.\u201d They received the following identifiers:\n\nCVE-2025-20700 (6.7, medium severity score) - missing authentication for GATT services\nCVE-2025-20701 (6.7, medium severity score) -  missing authentication for Bluetooth BR/EDR\nCVE-2025-20702 (7.5, high severity score) - critical capabilities of a custom protocol\nERNW researchers say they created a proof-of-concept exploit code that allowed them to read the currently playing media from the targeted headphones.\n\nWhile such an attack may not present a great risk, other scenarios leveraging the three bugs could let a threat actor hijack the connection between the mobile phone and an audio Bluetooth device and use the Bluetooth Hands-Free Profile (HFP) to issue commands to the phone.\n\n\u201cThe range of available commands depends on the mobile operating system, but all major platforms support at least initiating and receiving calls\u201d - ERNW\n\nThe researchers were able to trigger a call to an arbitrary number by extracting the Bluetooth link keys from a vulnerable device\u2019s memory.\n\nThey say that depending on the phone\u2019s configuration, an attacker could also retrieve the call history and contacts.\n\nThey were also able to initiate a call and \"successfully eavesdrop on conversations or sounds within earshot of the phone.\"\n\nFurthermore, the vulnerable device\u2019s firmware could potentially be rewritten to enable remote code execution, thereby facilitating the deployment of a wormable exploit capable of propagating across multiple devices.\n\nAttack restrictions apply\nAlthough the ERNW researchers present serious attack scenarios, practical implementation at scale is constrained by certain limitations.\n\n\u201cYes \u2014 the idea that someone could hijack your headphones, impersonate them towards your phone, and potentially make calls or spy on you, sounds pretty alarming.\u201d\n\n\u201cYes \u2014 technically, it is serious,\u201d the researchers say, adding that \u201creal attacks are complex to perform.\u201d\n\nThe necessity of both technical sophistication and physical proximity confines these attacks to high-value targets, such as those in diplomacy, journalism, activism, or sensitive industries.\n\nAiroha has released an updated SDK incorporating necessary mitigations, and device manufacturers have started patch development and distribution.\n\nNevertheless, German publication Heise says that the most recent firmware updates for more than half of the affected devices are from May 27 or earlier, which is before Airoha delivered the updated SDK to its customers.\n\n#CyberBulletin", "creation_timestamp": "2025-06-30T04:18:42.000000Z"}, {"uuid": "ed8b6c8a-b387-4f23-9ba3-ff751b5886c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://t.me/binarcat/4811", "content": "\ud83d\udd09 \u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u043d\u0430\u0443\u0448\u043d\u0438\u043a\u043e\u0432 Sony, JBL, Bose \u0438 Marshall \u043f\u0440\u0435\u0432\u0440\u0430\u0442\u0438\u043b\u0438\u0441\u044c \u0432 \u0438\u0434\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u0436\u0443\u0447\u043a\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u043a\u0438 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0430\u0439\u0432\u0430\u043d\u044c\u0441\u043a\u0438\u0445 \u0447\u0438\u043f\u0430\u0445 Airoha.\n\n\u0425\u0430\u043a\u0435\u0440 \u0432 \u0440\u0430\u0434\u0438\u0443\u0441\u0435 10 \u043c \u043c\u043e\u0436\u0435\u0442 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u0430\u0448\u0438\u043c \u043d\u0430\u0443\u0448\u043d\u0438\u043a\u0430\u043c \u0438 \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432, \u0434\u0430\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u043c\u0438\u043a\u0440\u043e\u0444\u043e\u043d \u0434\u043b\u044f \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u043a\u0438. \u041a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c CVE-2025-20702 \u043e\u0446\u0435\u043d\u0435\u043d\u0430 \u0432 9.6 \u0438\u0437 10 \u0431\u0430\u043b\u043b\u043e\u0432.\n\n\u0417\u0430\u0431\u0430\u0432\u043d\u043e, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u0438\u0434\u0435\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440.\n\n\u0425\u043e\u0440\u043e\u0448\u0438\u0435 \u043d\u043e\u0432\u043e\u0441\u0442\u0438: AirPods \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b, \u0442\u0430\u043c \u0434\u0440\u0443\u0433\u0438\u0435 \u0447\u0438\u043f\u044b. \u041f\u043b\u043e\u0445\u0438\u0435: \u0432\u0441\u0435\u043c \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u0436\u0434\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u043e\u0442 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e.\n\n\u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043d\u0430\u0443\u0448\u043d\u0438\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043b\u0443\u0448\u0430\u044e\u0442 \u043c\u0443\u0437\u044b\u043a\u0443 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0442\u043e\u0431\u043e\u0439.\n\n\ud83d\udc31 /start @binarcat", "creation_timestamp": "2025-06-30T16:44:49.000000Z"}, {"uuid": "5dcc452d-970c-446f-9537-dfe637dccb7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://t.me/HackerNewscyber/2180", "content": "\ud83d\udea8 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc \u062f\u0631 \u0647\u062f\u0641\u0648\u0646\u200c\u0647\u0627\u06cc Bose\u060c Sony \u0648 Beyerdynamic\n\n\u26aa\ufe0f\u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631 \u06a9\u0646\u0641\u0631\u0627\u0646\u0633 TROOPERS\u060c \u0633\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 (CVE-2025-20700 \u062a\u0627 20702) \u0631\u0627 \u062f\u0631 \u0686\u06cc\u067e\u200c\u0647\u0627\u06cc \u0634\u0631\u06a9\u062a \"Airoha\" \u0641\u0627\u0634 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0647\u062f\u0641\u0648\u0646\u200c\u0647\u0627\u06cc \u0628\u0631\u0646\u062f\u0647\u0627\u06cc \u0645\u0639\u062a\u0628\u0631\u06cc \u0686\u0648\u0646 Bose\u060c Sony \u0648 Beyerdynamic \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.  \n\n\u26aa\ufe0f\u26aa\ufe0f\u0627\u0645\u06a9\u0627\u0646 \u0641\u0639\u0627\u0644\u200c\u0633\u0627\u0632\u06cc \u0645\u062e\u0641\u06cc\u0627\u0646\u0647 \u0645\u06cc\u06a9\u0631\u0648\u0641\u0648\u0646 \u0648 \u0634\u0646\u0648\u062f \u06a9\u0627\u0631\u0628\u0631  \n\n\u26aa\ufe0f\u26aa\ufe0f\u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0628\u0647 \u0645\u06a9\u0627\u0644\u0645\u0627\u062a \u0648 \u062a\u0627\u0631\u06cc\u062e\u0686\u0647 \u062a\u0645\u0627\u0633\u200c\u0647\u0627  \n\n\u26aa\ufe0f\u26aa\ufe0f \u0627\u0631\u0633\u0627\u0644 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0628\u0647 \u062a\u0644\u0641\u0646 \u0647\u0645\u0631\u0627\u0647 \u06a9\u0627\u0631\u0628\u0631  \n\n\ud83d\udc9c@HackerNewsCyber", "creation_timestamp": "2025-07-02T08:45:28.000000Z"}, {"uuid": "55891a23-9100-4e9a-8f81-05dde1b518ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "published-proof-of-concept", "source": "https://t.me/CyberBulletin/3544", "content": "\u26a1\ufe0fBluetooth flaws could let hackers spy through your microphone\n\nVulnerabilities affecting a Bluetooth chipset present in more than two dozen audio devices from ten vendors can be exploited for eavesdropping or stealing sensitive information.\n\nResearchers confirmed that 29 devices from Beyerdynamic, Bose, Sony, Marshall, Jabra, JBL, Jlab, EarisMax, MoerLabs, and Teufel are affected.\n\nThe list of impacted products includes speakers, earbuds, headphones, and wireless microphones.\n\nThe security problems could be leveraged to take over a vulnerable product and on some phones, an attacker within connection range may be able to extract call history and contacts.\n\nSnooping over a Bluetooth connection\nAt the TROOPERS security conference in Germany, researchers at cybersecurity company ERNW disclosed three vulnerabilities in the Airoha systems on a chip (SoCs), which are widely used in True Wireless Stereo (TWS) earbuds.\n\nThe issues are not critical and besides close physical proximity (Bluetooth range), their exploitation also requires \u201ca high technical skill set.\u201d They received the following identifiers:\n\nCVE-2025-20700 (6.7, medium severity score) - missing authentication for GATT services\nCVE-2025-20701 (6.7, medium severity score) -  missing authentication for Bluetooth BR/EDR\nCVE-2025-20702 (7.5, high severity score) - critical capabilities of a custom protocol\nERNW researchers say they created a proof-of-concept exploit code that allowed them to read the currently playing media from the targeted headphones.\n\nWhile such an attack may not present a great risk, other scenarios leveraging the three bugs could let a threat actor hijack the connection between the mobile phone and an audio Bluetooth device and use the Bluetooth Hands-Free Profile (HFP) to issue commands to the phone.\n\n\u201cThe range of available commands depends on the mobile operating system, but all major platforms support at least initiating and receiving calls\u201d - ERNW\n\nThe researchers were able to trigger a call to an arbitrary number by extracting the Bluetooth link keys from a vulnerable device\u2019s memory.\n\nThey say that depending on the phone\u2019s configuration, an attacker could also retrieve the call history and contacts.\n\nThey were also able to initiate a call and \"successfully eavesdrop on conversations or sounds within earshot of the phone.\"\n\nFurthermore, the vulnerable device\u2019s firmware could potentially be rewritten to enable remote code execution, thereby facilitating the deployment of a wormable exploit capable of propagating across multiple devices.\n\nAttack restrictions apply\nAlthough the ERNW researchers present serious attack scenarios, practical implementation at scale is constrained by certain limitations.\n\n\u201cYes \u2014 the idea that someone could hijack your headphones, impersonate them towards your phone, and potentially make calls or spy on you, sounds pretty alarming.\u201d\n\n\u201cYes \u2014 technically, it is serious,\u201d the researchers say, adding that \u201creal attacks are complex to perform.\u201d\n\nThe necessity of both technical sophistication and physical proximity confines these attacks to high-value targets, such as those in diplomacy, journalism, activism, or sensitive industries.\n\nAiroha has released an updated SDK incorporating necessary mitigations, and device manufacturers have started patch development and distribution.\n\nNevertheless, German publication Heise says that the most recent firmware updates for more than half of the affected devices are from May 27 or earlier, which is before Airoha delivered the updated SDK to its customers.\n\n#CyberBulletin", "creation_timestamp": "2025-06-30T04:18:42.000000Z"}, {"uuid": "a054e2e9-9d3a-4102-86e1-265bd9eb43b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "published-proof-of-concept", "source": "https://t.me/CyberBulletin/3544", "content": "\u26a1\ufe0fBluetooth flaws could let hackers spy through your microphone\n\nVulnerabilities affecting a Bluetooth chipset present in more than two dozen audio devices from ten vendors can be exploited for eavesdropping or stealing sensitive information.\n\nResearchers confirmed that 29 devices from Beyerdynamic, Bose, Sony, Marshall, Jabra, JBL, Jlab, EarisMax, MoerLabs, and Teufel are affected.\n\nThe list of impacted products includes speakers, earbuds, headphones, and wireless microphones.\n\nThe security problems could be leveraged to take over a vulnerable product and on some phones, an attacker within connection range may be able to extract call history and contacts.\n\nSnooping over a Bluetooth connection\nAt the TROOPERS security conference in Germany, researchers at cybersecurity company ERNW disclosed three vulnerabilities in the Airoha systems on a chip (SoCs), which are widely used in True Wireless Stereo (TWS) earbuds.\n\nThe issues are not critical and besides close physical proximity (Bluetooth range), their exploitation also requires \u201ca high technical skill set.\u201d They received the following identifiers:\n\nCVE-2025-20700 (6.7, medium severity score) - missing authentication for GATT services\nCVE-2025-20701 (6.7, medium severity score) -  missing authentication for Bluetooth BR/EDR\nCVE-2025-20702 (7.5, high severity score) - critical capabilities of a custom protocol\nERNW researchers say they created a proof-of-concept exploit code that allowed them to read the currently playing media from the targeted headphones.\n\nWhile such an attack may not present a great risk, other scenarios leveraging the three bugs could let a threat actor hijack the connection between the mobile phone and an audio Bluetooth device and use the Bluetooth Hands-Free Profile (HFP) to issue commands to the phone.\n\n\u201cThe range of available commands depends on the mobile operating system, but all major platforms support at least initiating and receiving calls\u201d - ERNW\n\nThe researchers were able to trigger a call to an arbitrary number by extracting the Bluetooth link keys from a vulnerable device\u2019s memory.\n\nThey say that depending on the phone\u2019s configuration, an attacker could also retrieve the call history and contacts.\n\nThey were also able to initiate a call and \"successfully eavesdrop on conversations or sounds within earshot of the phone.\"\n\nFurthermore, the vulnerable device\u2019s firmware could potentially be rewritten to enable remote code execution, thereby facilitating the deployment of a wormable exploit capable of propagating across multiple devices.\n\nAttack restrictions apply\nAlthough the ERNW researchers present serious attack scenarios, practical implementation at scale is constrained by certain limitations.\n\n\u201cYes \u2014 the idea that someone could hijack your headphones, impersonate them towards your phone, and potentially make calls or spy on you, sounds pretty alarming.\u201d\n\n\u201cYes \u2014 technically, it is serious,\u201d the researchers say, adding that \u201creal attacks are complex to perform.\u201d\n\nThe necessity of both technical sophistication and physical proximity confines these attacks to high-value targets, such as those in diplomacy, journalism, activism, or sensitive industries.\n\nAiroha has released an updated SDK incorporating necessary mitigations, and device manufacturers have started patch development and distribution.\n\nNevertheless, German publication Heise says that the most recent firmware updates for more than half of the affected devices are from May 27 or earlier, which is before Airoha delivered the updated SDK to its customers.\n\n#CyberBulletin", "creation_timestamp": "2025-06-30T04:18:42.000000Z"}, {"uuid": "2d761790-56e5-4d09-a294-b05893625eb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-2070", "type": "seen", "source": "https://t.me/cvedetector/23759", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2070 - \"FileZ XML Parsing Denial of Service\"\", \n  \"Content\": \"CVE ID : CVE-2025-2070 \nPublished : April 25, 2025, 4:15 p.m. | 45\u00a0minutes ago \nDescription : An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a local user. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-25T19:11:03.000000Z"}, {"uuid": "2697e554-5fae-4add-801f-180d767a0836", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-2070", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lnnq76u5pz2y", "content": "", "creation_timestamp": "2025-04-25T17:19:50.589770Z"}, {"uuid": "0cd73bc7-0780-44c9-85bd-f0cdbe087b1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "cve-2025-20707", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lxrflchmv624", "content": "", "creation_timestamp": "2025-09-01T10:32:15.319588Z"}, {"uuid": "64666692-9c17-437c-bd82-61a44a9e682d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "published-proof-of-concept", "source": "https://t.me/cKure/15851", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Bluetooth Headphone Jacking: Full Disclosure of Airoha RACE Vulnerabilities.\n\nThis blog post is about CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702 vulnerabilities technical details in Airoha-based Bluetooth headphones and earbuds.\n\nhttps://insinuator.net/2025/12/bluetooth-headphone-jacking-full-disclosure-of-airoha-race-vulnerabilities/\n\nhttps://github.com/blackorbird/APT_REPORT/blob/master/exploit_report/Bluetooth%20Headphone%20Jacking%20Full%20Disclosure%20of%20Airoha%20RACE%20Vulnerabilities.pdf", "creation_timestamp": "2026-01-01T00:01:20.000000Z"}, {"uuid": "fb23455a-7759-4d98-b60b-031dd51455f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "published-proof-of-concept", "source": "https://t.me/cKure/15851", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Bluetooth Headphone Jacking: Full Disclosure of Airoha RACE Vulnerabilities.\n\nThis blog post is about CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702 vulnerabilities technical details in Airoha-based Bluetooth headphones and earbuds.\n\nhttps://insinuator.net/2025/12/bluetooth-headphone-jacking-full-disclosure-of-airoha-race-vulnerabilities/\n\nhttps://github.com/blackorbird/APT_REPORT/blob/master/exploit_report/Bluetooth%20Headphone%20Jacking%20Full%20Disclosure%20of%20Airoha%20RACE%20Vulnerabilities.pdf", "creation_timestamp": "2026-01-01T00:01:20.000000Z"}, {"uuid": "d63b5995-a1fc-4dc3-80ce-2fbb172e69b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "Telegram/mGI2CRHqQCjyvA6ju1XF5IWDLp0GZA5_xrkAMw9kytXRmaE", "content": "", "creation_timestamp": "2026-05-11T03:00:06.000000Z"}, {"uuid": "8f0086ed-3444-4d66-8047-09f68e84fa6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3lsshdtlu522v", "content": "", "creation_timestamp": "2025-06-30T05:30:34.190634Z"}, {"uuid": "a9d93812-7eb3-47dd-8d05-0c3fcc4cf288", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3lsshdtlu522v", "content": "", "creation_timestamp": "2025-06-30T05:30:34.302421Z"}, {"uuid": "9ad610d7-144b-4bfc-94ef-fb1905bc4a24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3lsshdtlu522v", "content": "", "creation_timestamp": "2025-06-30T05:30:34.398775Z"}, {"uuid": "ba0f2d2f-1e52-4468-a1e8-1bb737d692ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-3e512477-a27fd4f4fdac97f7", "content": "", "creation_timestamp": "2025-06-30T06:34:54.844777Z"}, {"uuid": "fa72b673-ab09-4285-8a62-8dcadb4104a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-3e512477-a27fd4f4fdac97f7", "content": "", "creation_timestamp": "2025-06-30T06:34:55.070489Z"}, {"uuid": "b040e204-58e1-4cdd-b45a-6b99889ec220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-3e512477-a27fd4f4fdac97f7", "content": "", "creation_timestamp": "2025-06-30T06:34:54.968438Z"}, {"uuid": "ef1b484e-1470-4b92-b7e2-c071ac38a5dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20709", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/115372817715516192", "content": "", "creation_timestamp": "2025-10-14T13:44:49.818285Z"}, {"uuid": "25ddd3ec-5cd8-48a5-a075-38be6a42aeac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "cve-2025-20702", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lvkogo3tue2d", "content": "", "creation_timestamp": "2025-08-04T07:31:42.291304Z"}, {"uuid": "e0fa0b6c-ef48-4d7f-83dc-d8e668dfcc4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lvktl3la3j2q", "content": "", "creation_timestamp": "2025-08-04T09:03:38.339992Z"}, {"uuid": "2de90775-9d2e-4751-a16b-e6b5383fd3f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://gist.github.com/ojsef39/f6bbd288da396f8da69e5cddd9336c55", "content": "", "creation_timestamp": "2025-12-27T19:01:43.000000Z"}, {"uuid": "94638e94-8b58-4bb9-81af-24d1df2d0278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://gist.github.com/ojsef39/f6bbd288da396f8da69e5cddd9336c55", "content": "", "creation_timestamp": "2025-12-27T19:01:43.000000Z"}, {"uuid": "364c02e7-087d-42be-8ffe-81086e407cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://gist.github.com/ojsef39/f6bbd288da396f8da69e5cddd9336c55", "content": "", "creation_timestamp": "2025-12-27T19:01:43.000000Z"}, {"uuid": "488999e9-2e5b-4764-b0f8-0fa99e245542", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mb4nc6zowr2b", "content": "", "creation_timestamp": "2025-12-29T10:36:20.953295Z"}, {"uuid": "d7d36af1-6160-4078-8b49-998e25443a99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/115804413362164750", "content": "", "creation_timestamp": "2025-12-29T19:05:16.359338Z"}, {"uuid": "9d6999b4-0879-4b23-ad82-bbc2f3dd664d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/115804413362164750", "content": "", "creation_timestamp": "2025-12-29T19:05:16.483737Z"}, {"uuid": "28c6a020-bbad-4d5e-8e34-fa3635d2e8f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/115804413362164750", "content": "", "creation_timestamp": "2025-12-29T19:05:16.604086Z"}, {"uuid": "96f4fc87-79f0-4164-b7ab-69d66c56d812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://threatintel.cc/2025/12/29/bluetooth-headphone-jacking-full-disclosure.html", "content": "", "creation_timestamp": "2025-12-29T18:05:23.000000Z"}, {"uuid": "0dd45a63-96d3-4623-bb8e-1354c44b353f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://threatintel.cc/2025/12/29/bluetooth-headphone-jacking-full-disclosure.html", "content": "", "creation_timestamp": "2025-12-29T18:05:23.000000Z"}, {"uuid": "9f7908d9-7b15-4bff-9097-a49aaa46d5fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20702", "type": "seen", "source": "https://threatintel.cc/2025/12/29/bluetooth-headphone-jacking-full-disclosure.html", "content": "", "creation_timestamp": "2025-12-29T18:05:23.000000Z"}, {"uuid": "bb780212-1dbc-40b9-93b9-07df8e6d04d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-2070", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/13474", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2070\n\ud83d\udd25 CVSS Score: 5.1 (cvssV4_0, Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a local user.\n\ud83d\udccf Published: 2025-04-25T15:27:19.989Z\n\ud83d\udccf Modified: 2025-04-25T16:46:25.734Z\n\ud83d\udd17 References:\n1. https://www.filez.com/securityPolicy/2.html?1744703100", "creation_timestamp": "2025-04-25T17:07:57.000000Z"}, {"uuid": "8291b184-b3e8-42ef-aa22-08b9d56f4358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20701", "type": "published-proof-of-concept", "source": "https://t.me/cKure/15851", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Bluetooth Headphone Jacking: Full Disclosure of Airoha RACE Vulnerabilities.\n\nThis blog post is about CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702 vulnerabilities technical details in Airoha-based Bluetooth headphones and earbuds.\n\nhttps://insinuator.net/2025/12/bluetooth-headphone-jacking-full-disclosure-of-airoha-race-vulnerabilities/\n\nhttps://github.com/blackorbird/APT_REPORT/blob/master/exploit_report/Bluetooth%20Headphone%20Jacking%20Full%20Disclosure%20of%20Airoha%20RACE%20Vulnerabilities.pdf", "creation_timestamp": "2026-01-01T00:01:20.000000Z"}, {"uuid": "96f8a1ab-6709-4938-9b88-0d7b2d15b090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "cve-2025-20708", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3lxr3jugt522c", "content": "", "creation_timestamp": "2025-09-01T07:32:29.886411Z"}, {"uuid": "40ec55a6-f3bc-4c55-81b8-2d5b2f1cfee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20705", "type": "seen", "source": "https://gist.github.com/Darkcrai86/56c8786e10d97be5fc0f0c4767586a16", "content": "", "creation_timestamp": "2025-09-01T08:58:31.000000Z"}, {"uuid": "696c4159-6bd4-44da-9a85-eb499bc1cfe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20704", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrasxlq4g2r", "content": "", "creation_timestamp": "2025-09-01T09:07:04.977918Z"}, {"uuid": "fc2d6a03-72b5-4f62-a4cf-ccf4cec28099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20705", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrazkeija2j", "content": "", "creation_timestamp": "2025-09-01T09:10:44.229666Z"}, {"uuid": "a2191b7f-aa8f-4f7e-8f77-04e8d2d3aa75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20706", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrb554kii27", "content": "", "creation_timestamp": "2025-09-01T09:12:44.452615Z"}, {"uuid": "e96b88a2-0ab1-441b-879a-bc5f2dad03d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20708", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrbf4gtax2n", "content": "", "creation_timestamp": "2025-09-01T09:17:12.120118Z"}, {"uuid": "624582f9-df7e-4504-a9ac-a16d452ac8b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-20707", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrboi5sqe27", "content": "", "creation_timestamp": "2025-09-01T09:22:26.258641Z"}]}