In the Airoha Bluetooth audio SDK

CVE-2025-20701 is a missing-authentication flaw in the Airoha Bluetooth audio SDK's handling of BR/EDR (Bluetooth Classic) pairing. An attacker within ~10 meters can silently pair to a vulnerable device — no user consent prompt, no prior authentication. Once paired, the attacker can chain this with CVE-2025-20702 (the RACE protocol flaw) to read/write device RAM and flash, extract stored Bluetooth Link Keys for paired phones, and ultimately impersonate the headphones to the victim's smartphone. From there, the Hands-Free Profile (HFP) exposes contacts, call audio, and voice-assistant control. Affected devices include 30+ models from Sony (WF-1000XM, WH-1000XM series), Bose (QuietComfort), JBL, Marshall, Beyerdynamic, Jabra, and Beats. Airoha shipped patched SDK versions (beyond v5.5.0 / v3.3.1) to manufacturers in June 2025, but as of September 2026 most device vendors have not released firmware updates to end users.

The vendor CVSS 8.8 HIGH is technically accurate for the Bluetooth attack surface — no auth, no UI, full C/I/A against the device. But for an enterprise security team managing hosts and infrastructure, this score dramatically overstates actionable risk. You cannot push firmware to employee headphones through SCCM, Intune, or any MDM. The attack vector is Adjacent (Bluetooth range, ~10m), meaning an attacker needs physical proximity to a specific person wearing specific headphones. The blast radius is one individual's audio stream and phone — there is no lateral movement to your domain, no fleet compromise, no data-tier exposure. This is a targeted espionage tool, not a network worm. For enterprise prioritization, MEDIUM is the right bucket.

Why this verdict

• Adjacent-only attack vector: CVSS AV:A means Bluetooth range (~10m physical proximity). This is not remotely exploitable over the network. An attacker must be co-located with the target, which eliminates opportunistic and automated exploitation at scale.
• Consumer peripheral, not enterprise infrastructure: Airoha BT SoCs are in headphones, earbuds, and speakers. These devices are not managed endpoints, not domain-joined, and not in the enterprise patch pipeline. Enterprise security teams have zero mechanism to deploy firmware updates to these devices.
• Role multiplier: no high-value enterprise role exists. Walking the role catalog — these are consumer audio peripherals. They are not identity providers, domain controllers, hypervisors, backup servers, CI/CD nodes, database engines, network edge appliances, or kernel-mode agents. The worst-case outcome is targeted eavesdropping on one individual's calls/audio. Blast radius: individual → phone → that person's call audio. No lateral movement to host, domain, or fleet. The high-value role floor does NOT apply.
• Public PoC increases urgency slightly: The RACE Toolkit on GitHub lowers the skill bar, but the physical proximity requirement remains an irreducible friction point that caps real-world exploitation volume.
• EPSS confirms low exploitation probability: At 0.078, the model agrees this is unlikely to see widespread exploitation — consistent with the Adjacent vector constraint.

Why not higher?

A HIGH rating would require either a network-reachable attack vector or a blast radius that threatens enterprise infrastructure. This CVE has neither. The attack is Bluetooth-range-only, targets consumer peripherals outside IT management scope, and the worst outcome is espionage on a single individual — not domain compromise, not fleet-wide impact. The public PoC raises awareness but doesn't change the physics of Bluetooth range.

Why not lower?

A LOW or IGNORE rating would understate the risk to high-value individuals (executives, board members, legal counsel) who may use affected Sony/Bose/JBL headphones for sensitive calls. The public PoC toolkit makes exploitation accessible to moderately skilled attackers. For organizations with espionage-relevant threat models (defense, finance, government), this deserves active attention even if not infrastructure-patchable.

1. Issue a BYOD/peripheral advisory identifying affected headphone models — Publish an internal security bulletin listing the 30+ affected models (Sony WF/WH-1000XM series, Bose QC, JBL, Marshall, Beyerdynamic, Jabra, Beats). Direct employees to check for firmware updates from their device manufacturer. This is your primary action since you cannot push patches centrally. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window.
2. Recommend wired headphones for sensitive meetings — For executive leadership, legal, board members, and anyone in an espionage-relevant role, recommend wired headphones or speakerphone for sensitive/classified calls. This eliminates the Bluetooth attack surface entirely.
3. Disable Bluetooth on corporate-managed phones in high-security zones — If your MDM supports it (Intune, Jamf, Workspace ONE), enforce a Bluetooth-off policy in SCIFs, boardrooms, or other sensitive areas. This prevents the impersonation step of the attack chain.
4. Add Airoha-based devices to your BT peripheral risk register — If you maintain an approved-peripherals list, flag affected models as 'pending vendor patch.' Review quarterly until manufacturers ship firmware updates.

Run this on any workstation with Python 3 and bleak installed (pip install bleak). It scans for nearby BLE devices and flags known-vulnerable Airoha-based models by checking for the RACE GATT service UUID. Requires no special privileges on macOS/Linux; on Windows, requires BLE-capable adapter. Usage: python3 airoha_check.py

#!/usr/bin/env python3
"""CVE-2025-20701 / Airoha RACE Vulnerability Scanner
Scans for nearby BLE devices exposing the Airoha RACE GATT service.
Requires: pip install bleak
Output: VULNERABLE / PATCHED / UNKNOWN per device found.
"""
import asyncio
import sys

try:
    from bleak import BleakScanner, BleakClient
except ImportError:
    print("ERROR: Install bleak first: pip install bleak")
    sys.exit(2)

# Known Airoha RACE GATT service UUIDs (primary identifiers)
RACE_SERVICE_UUIDS = [
    "2a680001-3782-49e8-ab22-1a7e4e860001",  # RACE primary
]

# Known vulnerable device name patterns (partial list)
VULNERABLE_PATTERNS = [
    "WF-1000XM", "WH-1000XM", "QuietComfort", "QC ",
    "Marshall ", "JBL ", "Jabra ", "Beyerdynamic",
    "Beats Studio Buds", "AIROHA",
]

async def scan():
    print("[*] Scanning for BLE devices (10 seconds)...")
    devices = await BleakScanner.discover(timeout=10.0, return_adv=True)
    if not devices:
        print("UNKNOWN - No BLE devices found in range.")
        return 3

    found_vulnerable = False
    for addr, (device, adv_data) in devices.items():
        name = device.name or "Unknown"
        service_uuids = [str(u).lower() for u in (adv_data.service_uuids or [])]
        
        # Check for RACE service UUID
        race_exposed = any(ruuid in service_uuids for ruuid in RACE_SERVICE_UUIDS)
        
        # Check for known vulnerable device name patterns
        name_match = any(p.lower() in name.lower() for p in VULNERABLE_PATTERNS)
        
        if race_exposed:
            print(f"VULNERABLE - {name} ({addr}) exposes RACE GATT service. Likely unpatched Airoha device.")
            found_vulnerable = True
        elif name_match:
            print(f"UNKNOWN - {name} ({addr}) matches known affected model but RACE service not confirmed via BLE advertisement. Check firmware version manually.")
    
    if not found_vulnerable:
        print("PATCHED - No devices exposing RACE GATT service found in range.")
        return 0
    return 1

if __name__ == "__main__":
    rc = asyncio.run(scan())
    sys.exit(rc)

Sources

1. ERNW Security Advisory (Original Disclosure)
2. ERNW Full Disclosure & Technical Details
3. RACE Toolkit (PoC on GitHub)
4. Dark Reading — Airoha Chip Vulns
5. GitHub Advisory GHSA-jf8q-5hx8-3j27
6. SecurityWeek — Airoha Chip Vulnerabilities
7. CyberInsider — Exploit Tool Available