{"uuid": "3b194c1e-8877-43e8-a0ab-49ce3ed4d572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20700", "type": "seen", "source": "https://t.me/hn_best_comments/27662", "content": "Re: Bluetooth Headphone Jacking: A Key to Your Phone [video]\n\nGlad this submission is finally receiving upvotes.\n\nThis was just shown at the 39C3 in Hamburg, few days back.\n\nCommon (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702)\n\nThis includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ...\n\n> Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active).\n\nMost vendors gave the security researchers either silent treatment or were slow, even after Airoha published fixes. Jabra was one of the positive outlier, Sony unfortunately negatively.\n\nWhat is exciting, even though the flaws are awful, that it is unlikely for current generation of those Airoha bluetooth headsets to change away from Aiorha's Bluetooth LE \"RACE\" protocol. This means there is great opportunity for Linux users to control their Bluetooth headsets, which for example is quite nice in an office setting to toggle \"hearthrough\" when toggling volume \"mute\" on your machine.\n\nRACE Reverse Engineered - CLI Tool: https://github.com/auracast-research/race-toolkit\n\nI feel like this should receive state-level attention, the remote audio surveillance of any headset can be a major threat. I wonder what the policies in countries official buildings are when it comes to Bluetooth audio devices, considering that Jabra is a major brand for conference speakers, I'd assume some actual espionage threats.\n\nmiduil, 12 hours ago", "creation_timestamp": "2026-07-29T12:01:06.585171Z"}