Skullcandy Earbud Flaw Exposes Microphones To Remote Attackers

by Aaron Leong — Thursday, September 10, 2026, 09:44 AM EDT

A Bluetooth security flaw was found in the Skullcandy Dime 3 - Image: Skullcandy

A security flaw in Skullcandy's Dime 3 wireless earphones allows nearby attackers to hijack Bluetooth connections, intercept audio playback, and access built-in microphones without any user interaction or physical confirmation.

To be specific, the vulnerability affects Dime 3s running firmware version 1.0.0.28. The bug stems from an unauthenticated Bluetooth pairing flaw tracked as CVE-2025-20701, which resides within the underlying Airoha Bluetooth Audio SDK used by the manufacturer. Originally presented by cybersecurity researchers at ERNW, the underlying flaw represents a missing-authentication issue in the Bluetooth stack that allows incoming connection requests to complete automatically without user consent.

A vulnerability advisory issued by the Carnegie Mellon University CERT Coordination Center (CERT/CC), initiated after a tip from researcher Jacob Nowak, warns that an attacker within wireless radio range can initiate a Bluetooth Classic request to a pair of Dime 3s. Because the buds employ a "NoInputNoOutput" I/O profile, the Bluetooth stack accepts incoming pairing requests without requiring a PIN, a passkey, physical button presses, or placing the earbuds into manual pairing mode.

So, once an attacker completes the unauthorized pairing sequence, their device is added to the earbuds' trusted device list. This allows the rogue device to automatically reconnect whenever it comes within range of the target. The attacker can then utilize A2DP streams to disrupt active audio sessions, stop legitimate playback, or play arbitrary audio directly into the victim's ears... or worse. By leveraging the Hands-Free/Headset profile (HFP/HSP), an attacker can access the built-in microphone array, thus transforming the device into a remote eavesdropping tool that streams live ambient room audio.

Since these buds are a dime-a-dozen, no one can really tell for sure if their buds are - Image: Skullcandy

The only indication that an intrusion has occurred is a brief chime or an automated "New device paired" audio prompt. However, this plays only after the remote connection has already succeeded, leaving users with no opportunity to reject or prevent the hijacking in real time. In busy public places like cafes, public transit, or airports, users are also likely to miss the audio cue altogether.

To its credit, Airoha has already issued SDK patches and Skullcandy resolved the issue in firmware version 1.0.0.30, which should be preinstalled in new production batches. However, since the Dime 3 does not support over-the-air firmware updates via the mobile Skullcandy app, there is currently no way for owners of units running firmware version 1.0.0.28 to upgrade to the patched version.

For units running 1.0.0.28, we advise users to power off their earbuds completely when not actively in use or keep them out of Bluetooth range of untrusted devices in public environments. That said, if you've been shopping for a Dime 3 (and like living on the edge), they're going for $24.99 (previously $34.99) right now.