PT-2025-27364 · Jabra+1 · Jabra+1

Dennis Heinze + 2 · Published 2025-06-29 · Updated 2026-01-03 · CVE-2025-20702

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airoha Bluetooth audio SDK (affected versions not specified)

Description The Airoha Bluetooth audio SDK contains a flaw involving unauthorized access to the RACE protocol. This access could allow for remote escalation of privilege without requiring additional execution privileges, and does not require user interaction for exploitation. Reports indicate that devices utilizing Airoha chips may be susceptible to unauthorized access and eavesdropping due to a lack of authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-01013

CVE-2025-20702

Affected Products

Airoha Chips

Jabra

References · 35

• https://nvd.nist.gov/vuln/detail/CVE-2025-20702 · Security Note
• https://bdu.fstec.ru/vul/2026-01013 · Security Note
• https://airoha.com/product-security-bulletin/2025 · Note
• https://twitter.com/infiltr08/status/1941894497002041745 · Twitter Post
• https://twitter.com/gravax/status/2007500789292712115 · Twitter Post
• https://twitter.com/Strivehawk/status/1940112534088163832 · Twitter Post
• https://twitter.com/mountainman1977/status/1939232833546944662 · Twitter Post
• https://t.me/CVEtracker/29076 · Telegram Post
• https://twitter.com/ThreatSynop/status/2005725607272059382 · Twitter Post
• https://twitter.com/CVEnew/status/1952257513207869573 · Twitter Post
• https://i.redd.it/q7ordet1npqf1.png · Reddit Post
• https://twitter.com/cracbot/status/1954135610978869255 · Twitter Post
• https://twitter.com/mrtechsense/status/1943930864397955109 · Twitter Post
• https://securitylab.ru/news/560852.php · Note
• https://twitter.com/AphixJS/status/2005049617776628041 · Twitter Post