Skullcandy Dime 3 earbuds let strangers pair over Bluetooth with no PIN, and owners can't patch them

Key points

• Skullcandy Dime 3 earbuds (model S2DCW) running firmware 1.0.0.28 accept Bluetooth pairing from strangers without any approval or PIN.
• The flaw is CVE-2025-20701, a missing-authentication bug in the Airoha Bluetooth Audio SDK used by many earbud brands.
• Once paired, an attacker within Bluetooth range can hijack audio and capture live microphone sound from the earbuds.
• Skullcandy fixed the flaw in firmware 1.0.0.30, but the Skullcandy app offers no way for owners to update.
• CERT/CC published the advisory after a tip from researcher Jacob Nowak.

Skullcandy's Dime 3 wireless earbuds will pair with any Bluetooth device nearby without asking the owner first. That's according to a new advisory from the CERT Coordination Center (CERT/CC) at Carnegie Mellon University, first reported by BleepingComputer.

The problem sits in a chip supplied by Airoha, a Taiwanese company whose Bluetooth Audio software development kit (SDK), the pre-built code manufacturers drop into products to handle wireless audio, is used inside earbuds and headphones from many brands. In the Dime 3, that SDK skips a basic check: it doesn't confirm the owner actually wants a new device to connect.

When we covered the same CVE on 19 June, Apple had already shipped a firmware fix for its Beats Studio Buds. Skullcandy hasn't.

What can an attacker actually do?

Someone within Bluetooth range, roughly the width of a coffee shop, can silently pair their phone or laptop to your earbuds. No PIN, no pop-up asking you to approve it, no need to open the charging case.

Once paired, the attacker's device is treated as trusted. It can reconnect automatically whenever it's nearby, cut into your audio, play its own sound through your earbuds, and switch on the headset profile to record what the microphone picks up. That includes your side of any conversation happening near you.

You might hear a brief "new device paired" chime, but most people will shrug it off as a glitch.

Which product and firmware are affected?

The bug was found by researchers at German security firm ERNW and presented at the TROOPERS conference last year. It affects Airoha-based audio products across several brands, not just Skullcandy.

Why can't owners just update?

Because Skullcandy hasn't built an update path into its app. CERT/CC's advisory is blunt: "Existing units running the vulnerable firmware cannot currently be updated by customers through the app... There are no known consumer-accessible methods to update an existing unit from the affected firmware version 1.0.0.28 to version 1.0.0.30."

The fix exists, but it only helps units that shipped with the newer firmware already installed. Anyone who bought a Dime 3 earlier is stuck.

Skullcandy hasn't responded publicly. Its customer support runs through a chatbot that doesn't accept press queries.

Should you worry?

If you paid full price for a product that can be silently hijacked and can't be patched, yes. The microphone risk is the part that matters most here: this isn't a theoretical eavesdropping scenario, it's a working exploit against a device people wear during phone calls, medical appointments and work meetings.

What should Dime 3 owners do?

Until Skullcandy offers a real update route, treat the earbuds as untrusted in any private setting.

• Check your firmware version in the Skullcandy app. If it reads 1.0.0.28, you're affected.
• Keep the earbuds in their case when you're not actively using them. Powered-down buds can't be paired to.
• Watch your paired-devices list. If an unfamiliar device appears, remove it and factory-reset the earbuds.

In the United States the FTC has previously taken action against manufacturers who ship products with unfixable security defects. In the UK, the Product Security and Telecommunications Infrastructure (PSTI) regime now requires connected consumer devices to support security updates for a defined period, which is exactly the gap on display here.