{"uuid": "9c03d35c-7b09-4bbd-9960-fee351c40f07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20701", "type": "seen", "source": "https://t.me/itpgchannel/3744", "content": "https://www.facebook.com/ethical.hack.group/posts/pfbid032cJSREZHEDefgq9aKkotMAYpRuKs7mNujarsnNjaSok2wPnXmo124ajfo5Un1FLzl\n\nYour headphones just became a backdoor to your phone. No pairing. No popup. Just Bluetooth range. 70 million chips. Sony. Bose. Marshall. JBL. A debug protocol active on production devices. Attackers can dump your Bluetooth keys, impersonate your headphones, and hijack your phone. \ud83e\udd14\nThree CVEs. Zero authentication required. Full technical disclosure: December 27, 2025 at 39C3.\n\nThe vulnerabilities\n\n\u2192 CVE-2025-20700: No authentication on Bluetooth Low Energy\n\u2192 CVE-2025-20701: No authentication on Bluetooth Classic\n\u2192 CVE-2025-20702: Debug protocol exposed that should never be accessible\n\nRACE is Airoha's factory protocol. Meant for testing and firmware updates during production. It exposes read/write access to RAM and flash memory over three channels: USB HID, Bluetooth Classic RFCOMM (channel 21), and BLE GATT services.\n\nThe protocol was never disabled before shipping.\n\nAn attacker within 10 meters connects via BLE or Bluetooth Classic. No user interaction. The connection is silent.\nOnce connected, RACE commands dump the flash. Inside: the Bluetooth Link Key. This 128-bit key is what your phone uses to verify your headphones are trusted.\n\nWith the Link Key, the attacker clones your headphones' Bluetooth identity. Your phone sees \"Sony WH-1000XM5\" connecting. It trusts it automatically. No pairing popup.", "creation_timestamp": "2026-07-29T12:00:04.941964Z"}