Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking

A vulnerability in the Airoha Bluetooth Audio SDK (CVE-2025-20701) allows attackers in physical proximity to pair with Skullcandy Dime 3 earbuds without any user interaction, enabling audio hijacking and covert microphone capture. The root issue stems from a third-party SDK embedded in the device firmware that lacked sufficient pairing authentication controls — a classic supply chain risk where a downstream vendor's flaw becomes the end user's exposure. Critically, while Skullcandy issued a patch in firmware 1.0.0.30, the device architecture prevents older firmware from being updated, permanently stranding a portion of users in a vulnerable state. This highlights two compounding failures: inadequate secure update mechanisms in IoT device design, and the absence of a lifecycle policy ensuring all devices can receive security patches. The case underscores why consumers and enterprises must scrutinize the security posture of IoT devices before deployment.