Skullcandy Dime 3 Earbuds Expose Critical Bluetooth Vulnerability
Recent developments have revealed a significant vulnerability concerning the Skullcandy Dime 3 wireless earbuds, specifically related to unauthenticated Bluetooth pairing. This flaw poses a serious risk, allowing potential attackers within proximity to silently pair their devices with the earbuds. Such unauthorized connections enable attackers to disrupt legitimate audio sessions and, worryingly, capture audio from the earbuds’ microphone.
This vulnerability has been tracked as VU#859658 by the CERT Coordination Center, which disclosed the issue on September 8, 2026. The affected model, identified as S2DCW, runs on firmware version 1.0.0.28. Users are being warned that the earbuds can accept Bluetooth Classic pairing requests from unidentified devices, even when the owner has not actively placed the earbuds in pairing mode.
The Technical Background of the Flaw
The vulnerability is linked to CVE-2025-20701, which had previously been reported in implementations of Airoha Bluetooth audio SDKs. The Skullcandy Dime 3 earbuds are confirmed to utilize a Bluetooth chipset from Airoha Technology Corp., as indicated by their Bluetooth SIG company ID 0x0094.
In normal Bluetooth audio device operations, user intervention is a critical prerequisite for pairing. A user typically must initiate the pairing process by placing the device in pairing mode, either through the charging case or using physical buttons. However, the firmware flaw in the Dime 3 earbuds circumvents this expectation, as it allows direct Bluetooth Classic BR/EDR pairing requests to be accepted from previously unpaired devices without any user action.
An attacker merely needs to be within the Bluetooth range—approximately 30 feet—and must either know, discover, or obtain the Bluetooth Classic device address of the earbuds. Disturbingly, no prior connection, PIN, or user confirmation is required for the pairing to proceed successfully.
Consequences of Unauthorized Pairing
Once an attacker has successfully paired their device with the vulnerable earbuds, it can reconnect automatically whenever the attacker is within range. The CERT Coordination Center warns that an attacker can establish an Advanced Audio Distribution Profile (A2DP) connection, potentially disrupting the legitimate audio session that the owner has with their phone, computer, or any other paired device.
This unauthorized connection could effectively hijack the audio session, creating a scenario where the attacker sends audio to the earbuds while simultaneously disconnecting or interrupting the legitimate audio stream from the authorized user. Such a situation raises not only security concerns but also significant privacy issues.
While the earbuds do provide an audio notification indicating that a "New device paired" event has occurred after the unauthorized pairing is successful, this alarm is too late. It serves merely as an acknowledgment of an event that has already transpired—one that poses a privacy threat to the legitimate owner.
Moreover, attackers may leverage additional Bluetooth profiles such as the Hands-Free Profile or Headset Profile, thereby gaining the ability to capture live audio via the earbuds’ microphone. This vulnerability could potentially enable eavesdropping during sensitive conversations in public places, offices, transport hubs, or other shared environments.
Lack of Update Options and User Recommendations
In light of this vulnerability, Skullcandy reportedly considers firmware version 1.0.0.30 to be an effective solution against CVE-2025-20701. However, a significant concern arises from the fact that the Dime 3 earbuds do not support firmware updates through the Skullcandy mobile application. Consequently, users operating with firmware version 1.0.0.28 currently have no available means to upgrade to a patched version.
This absence of end-user update options leaves affected devices exposed to potential attacks, underscoring an urgent need for customers to remain vigilant. Users are advised to watch out for unexpected pairing notifications, actively remove any unfamiliar Bluetooth connections, and refrain from using the earbuds for sensitive conversations in area where they could be overheard.
Given the prevalence of Bluetooth technology in consumer devices today, it is essential for manufacturers to prioritize user security, providing timely updates and effective mitigation strategies. Until a resolution is offered, users will have to exercise caution, safeguarding their privacy and ensuring their audio experience remains unencumbered by unauthorized access.