PT-2025-27363 · Airoha · Airoha Bluetooth Audio Sdk

Dennis Heinze + 2 · Published 2025-06-29 · Updated 2026-01-03 · CVE-2025-20701

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airoha Bluetooth audio SDK (affected versions not specified)

Description The Airoha Bluetooth audio SDK contains a flaw that allows Bluetooth audio devices to pair without user consent. This can result in remote escalation of privilege without requiring additional execution privileges. Exploitation does not require user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Authorization

Missing Authentication

Weakness Enumeration

CWE-863

CWE-306

Related Identifiers

BDU:2026-01012

CVE-2025-20701

Affected Products

Airoha Bluetooth Audio Sdk

References · 35

• https://bdu.fstec.ru/vul/2026-01012 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20701 · Security Note
• https://twitter.com/AphixJS/status/2005049617776628041 · Twitter Post
• https://insinuator.net/2025/06/airoha-bluetooth-security-vulnerabilities · Note
• https://twitter.com/SacreedTol/status/1942769440338161815 · Twitter Post
• https://twitter.com/fbi__open__up/status/1967992055000600685 · Twitter Post
• https://twitter.com/imnightmare7/status/2007526717695664566 · Twitter Post
• https://securitylab.ru/news/560852.php · Note
• https://twitter.com/cyberuncrack/status/1942802517248680341 · Twitter Post
• https://t.me/cveNotify/130730 · Telegram Post
• https://twitter.com/ThreatSynop/status/2005729973982917064 · Twitter Post
• https://twitter.com/ThreatSynop/status/2005725607272059382 · Twitter Post
• https://twitter.com/gringo_ctm/status/2007183415150608577 · Twitter Post
• https://airoha.com/product-security-bulletin/2025 · Note
• https://t.me/cKure/16725 · Telegram Post