Carnegie Mellon University’s CERT Coordination Center is warning that Skullcandy Dime 3 wireless earbuds (model S2DCW) running firmware version 1.0.0.28 automatically accept Bluetooth pairing requests from unknown devices without asking the user for confirmation or a PIN. The underlying issue is CVE-2025-20701, a missing-authentication flaw in the Airoha Bluetooth Audio SDK that affects a range of wireless audio products. Anyone within Bluetooth range — typically 10 metres or so in a coffee shop, office, or public transit — can silently pair with the earbuds. Once paired, the rogue device is remembered as trusted, can automatically reconnect whenever it’s nearby again, interrupt the owner’s audio playback, and access the headset microphone to capture live audio.
The owner’s only potential clue is a “new device paired” notification that is easy to dismiss or miss entirely during normal use. Skullcandy pushed a patched firmware (version 1.0.0.30) that closes the vulnerability, but here is the catch: there is currently no way for existing Dime 3 owners to update the firmware on a unit that shipped with version 1.0.0.28. Neither the Skullcandy mobile app nor any published manual process performs the upgrade. CERT/CC confirmed as of its writing that consumer-accessible firmware update tools do not exist for this model, and BleepingComputer was unable to get a response from Skullcandy about the situation. Buyers who purchased the earbuds before the firmware change was distributed at the factory level remain permanently unprotected unless Skullcandy releases an update path.
How to check if you’re affected
Affected models are the Skullcandy Dime 3 earbuds (model number S2DCW) running firmware version 1.0.0.28. Open the Skullcandy app and check the device firmware version if possible; units shipped with version 1.0.0.28 and with no update mechanism available are vulnerable. If you own a pair of Dime 3 earbuds and cannot confirm the firmware version is 1.0.0.30 or later, treat the device as vulnerable. In practice, the safest immediate step is to avoid using the earbuds in crowded public spaces where a nearby attacker could silently connect, or to stop using them until Skullcandy provides an update path.