Apple patches Beats Studio Buds Bluetooth eavesdropping flaw

Apple has addressed a significant security flaw in its Beats Studio Buds wireless earbuds that could have allowed attackers to monitor users' conversations without their knowledge. The vulnerability, identified as CVE-2025-20701, was patched in firmware update 1B211, which is automatically delivered to devices when they are paired with an iPhone, iPad, or Mac within Bluetooth range. Users can verify the update through their device's Bluetooth settings by selecting the info option next to their headphones listing.

The issue was rooted in the Airoha system-on-a-chip (SoCs) used in the earbuds, specifically within the Bluetooth BR/EDR radio component. Security researchers Dennis Heinze and Frieder Steinmetz from ERNW GmbH discovered the flaw, which stemmed from a missing authentication mechanism. This weakness allowed attackers within Bluetooth range to access the microphone of a device that was not yet paired but actively seeking connection requests. The researchers demonstrated that the vulnerability could be exploited to initiate calls and listen in on conversations near the targeted device.

Technical details and risks

The ERNW team disclosed the vulnerability one year prior at the TROOPERS security conference in Germany, alongside two related flaws (CVE-2025-20700 and CVE-2025-20702) affecting the same hardware component. When combined, these vulnerabilities enabled attackers to fully compromise the earbuds via Bluetooth, requiring no prior pairing or authentication. The attack surface included both Bluetooth BR/EDR and Bluetooth Low Energy (BLE) protocols, with the only prerequisite being proximity to the target device.

The researchers noted that while the attack was technically complex, it could be used to extract sensitive data from vulnerable devices. By chaining the vulnerabilities, attackers could read and write to the device's RAM and flash memory, retrieve call history and contacts, and even initiate calls to arbitrary numbers. The Bluetooth Hands-Free Profile (HFP) could be hijacked to issue commands to the paired phone, though the extent of available commands depended on the mobile operating system. Apple's advisory clarified that the flaw originated in open-source code, with the CVE identifier assigned by a third party.

Mitigation and industry implications

Apple's automatic firmware update mechanism ensures that most users will receive the patch without manual intervention, provided their earbuds are paired with an Apple device. However, the incident underscores broader concerns about Bluetooth security, particularly in consumer audio devices. The ERNW researchers emphasized that such vulnerabilities are not limited to Beats products, as the Airoha SoCs are widely used across multiple brands. They advised users to keep their devices updated and to avoid leaving Bluetooth enabled in untrusted environments.

While the researchers suggested that real-world attacks would likely target high-value individuals due to the technical complexity involved, the widespread adoption of Bluetooth audio devices makes this a notable risk for enterprises. The incident also serves as a reminder for manufacturers to rigorously test third-party components, especially open-source code, for security weaknesses before integration into consumer products.