Bluetooth Flaws Could Let Hackers Spy Through Your Microphone
An Anonymous Coward writes:
Vulnerabilities affecting a Bluetooth chipset present in more than two dozen audio devices from ten vendors can be exploited for eavesdropping or stealing sensitive information.
Researchers confirmed that 29 devices from Beyerdynamic, Bose, Sony, Marshall, Jabra, JBL, Jlab, EarisMax, MoerLabs, and Teufel are affected.
The list of impacted products includes speakers, earbuds, headphones, and wireless microphones.
The security problems could be leveraged to take over a vulnerable product and on some phones, an attacker within connection range may be able to extract call history and contacts.
Snooping over a Bluetooth connectionAt the TROOPERS security conference in Germany, researchers at cybersecurity company ERNW disclosed three vulnerabilities in the Airoha systems on a chip (SoCs), which are widely used in True Wireless Stereo (TWS) earbuds.
The issues are not critical and besides close physical proximity (Bluetooth range), their exploitation also requires "a high technical skill set." They received the following identifiers:
CVE-2025-20700 (6.7, medium severity score) - missing authentication for GATT services
CVE-2025-20701 (6.7, medium severity score) - missing authentication for Bluetooth BR/EDR
CVE-2025-20702 (7.5, high severity score) - critical capabilities of a custom protocolERNW researchers say they created a proof-of-concept exploit code that allowed them to read the currently playing media from the targeted headphones.
[...] Although the ERNW researchers present serious attack scenarios, practical implementation at scale is constrained by certain limitations.
"Yes - the idea that someone could hijack your headphones, impersonate them towards your phone, and potentially make calls or spy on you, sounds pretty alarming."
"Yes - technically, it is serious," the researchers say, adding that "real attacks are complex to perform."
The necessity of both technical sophistication and physical proximity confines these attacks to high-value targets, such as those in diplomacy, journalism, activism, or sensitive industries.
Airoha has released an updated SDK incorporating necessary mitigations, and device manufacturers have started patch development and distribution.
Nevertheless, German publication Heise says that the most recent firmware updates for more than half of the affected devices are from May 27 or earlier, which is before Airoha delivered the updated SDK to its customers.
Read more of this story at SoylentNews.