
Spy Attack Alert For Headphone Users — Is Yours On The At Risk List?
Hackers are, by their very nature, ingenious and inventive. It comes as part of the job description, and so this latest revelation should come as no surprise. After all, we've already seen hackers using printers, lightbulbs, vacuum cleaners and smartwatches in attack scenarios. Not to mention automatic password hacking machines and, of course, critical vulnerability exposure. And it's the latter, a vulnerability, that brings us nicely to the threat at hand. Researchers have found that more than two dozen earbuds, headphones, speakers and wireless mics from big-name brands are vulnerable to an attack that could see a skilled hacker successfully spying on the user, and even exfiltrating data from some smartphones. Here's what you need to know.
Listen Carefully — This Spy Threat Comes Via Your Audio Tech
There's something particularly insidious about a security threat that can exploit the technology we use to escape from the hubbub, to unwind, listen to music and podcasts, and spy on us. What's more, according to Dennis Heinze, a security analyst and researcher at ERNW, 'any vulnerable device can be compromised if the attacker is in Bluetooth range. That is the only precondition.' Now that, dear reader, is somewhat concerning.
A recently published security alert by security researchers at ERNW has identified several Bluetooth security vulnerabilities affecting audio devices, including those from well-known earphone and headphone brands that utilize Airoha Systems on a Chip.
Airoha is 'a large supplier in the Bluetooth audio space, especially in the area of True Wireless Stereo (TWS) earbuds,' Heinze said. While stating that ERNW does not want to disclose proof of concept code or too many technical details at this point, Heinze added that he wanted 'inform about these vulnerabilities, especially their impact and the difficulties around patching them.'
What ERNW and Heinze have said, however, is that, in most cases, 'these vulnerabilities allow attackers to fully take over the headphones via Bluetooth.' There is absolutely no authentication or pairing involved, as long as the hacker is within Bluetooth range, your headphones could be vulnerable. The researcher said that attackers could read and write to device RAM and flash memory, and could 'hijack established trust relationships with other devices, such as the phone paired to the headphones.'
CVE-2025-20700 (missing authentication for the Generic Attribute Profile service) and CVE-2025-20701 (missing authentication for Bluetooth Basic Rate/Enhanced Data Rate) are both high-risk vulnerabilities with a severity rating of 8.8/10. However, CVE-2025-20702, which Heinze described as presenting 'critical capabilities of a custom protocol,' has been given a critical rating, under the Common Vulnerability Scoring System, of 9.6/10.
The Threat From These Audio Spy Attacks Explained
Like many such reports, although the headline threat is indeed rather worrying, the real-world impact is likely to be significantly less, in my never humble opinion. 'One attack we implemented was reading out the currently playing media from the headphones via the RAM reading commands,' Heinze said. More worryingly, Heinze reported that exploiting the broken BR/EDR pairing was able to allow an attacker to listen to what the device microphone was recording. Again, in the real-world this wouldn't be very secret squirrel as the exploit would cause whatever the victim was listening to be dropped. 'For it to go unnoticed,' Heinze confirmed, 'headphones have to be turned on, but not in active use.'
And then we come to the smartphone issue. This exploits the trust between a Bluetooth device and the phone it has paired with. 'If an attacker can impersonate the headphones they could hijack this trust relationship in numerous ways,' Heinze said, including issuing commands to the smartphone in question. ERNW was able to demonstrate an exploit, using a full attack chain, that allowed for the calling of an arbitrary number from the smartphone. 'Under the right conditions,' Heinze warned, 'the established call allowed us to successfully eavesdrop on conversations or sounds within earshot of the phone.' It also allows for the extraction of call history and stored contacts data, Heinze said.
Most people do not need to panic, with journalists, diplomats, political dissidents, people in sensitive industries and VIPs under surveillance being named as the most likely targets of any attacks. The kind of people who should know not to use Bluetooth headphones. Everyone, Heinze said, should patch their firmware as soon as one becomes available. In the meantime, at-risk users might want to wait for a patch until they use their headphones again. 'Please ensure that you also remove the pairing between the headphones and your mobile phone,' Heinze added.
'Ensuring complete trust in software and the technologies it supports is incredibly challenging,' Boris Cipot, a senior security engineer at Black Duck, said. With every new advancement comes the risk of unknown vulnerabilities, of course, flaws that may only be uncovered later by dedicated security researchers, Cipot warned.
'What matters most now is delivering timely updates and patches so users can operate their devices without worrying about being compromised,' Cipot said; 'Vendors using Airoha TWS technology must ensure customers receive these critical updates seamlessly via an automated upgrade process. Relying on users to manually update their devices simply isn't effective.'
The Spy Attack Headphones At Risk List
Heinze has said that Airoha has fixed the vulnerabilities in the software development kit and supplied a new version to device manufacturers in the first week of June. The manufacturers now have to build and distribute firmware updates, so expect to see these soon if they have not dropped already.
I have approached Airoha for a statement
'We can confirm that the issues are prevalent in many entry-level and flagship models,' Heinze said, adding that ERNW confirmed Beyerdynamic, Marshall and Sony as impacted vendors. 'We know of many more devices using the chips that we assume to be vulnerable, too,' Heinze concluded.
The following devices were listed as being vulnerable by the ERNW researchers:
A Jabra spokesperson provided the following statement:
'At Jabra we are aware of the recently discovered Bluetooth vulnerability for Airoha chipset devices, which include the Jabra Elte 8 and Elite 10 earbuds. We have taken steps immediately to work on a firmware update to include the Airoha security patch and this will be rolled out very shortly. Jabra continues to support the Elite 8 and 10 earbuds despite having stopped the production of the Elite product line last year. We want to emphasize that no other Jabra audio devices or headsets within our portfolio are affected by this vulnerability.'
I have contacted all the vendors listed above for a statement regarding the spy exploit research and will update this article when I have further information.
Hashtags

Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles


Forbes
14 minutes ago
- Forbes
New Technical Jewelry Symposium To Premiere At Vicenzaoro Jewelry Fair
The Science of jewelry making and adornment will be part of the September Vicenzaoro jewelry fair For the first time in its 70-year history, the Vicenzaoro jewelry trade fair will host an adjacent gathering dedicated to metallurgy and jewelry manufacturing processes. Called the Vicenza Symposium, it will be held September 2 -4 Vicenza, Italy, prior to Vicenzaoro on September 5 -7. Both events are B2B focused, open only to the jewelry trade. The Vicenza Symposium is modeled after the Santa Fe Symposium with the objective of advancing jewelry making technology, the science of adornment if you will. The three-day event is modeled after the Santa Fe Symposium, founded in 1987 by Eddie Bell, the retired CEO of Rio Grande, an Albuquerque, N.M., company the manufactures, markets and sells jewelry-making supplies. He held his last symposium in 2022 following his retirement. By this time, it was the world's most important event on the technology and science of metallurgy and jewelry making, attracting professionals from around the world. This new event is an attempt to maintain the community that Bell established. In fact, Bell was named honorary president and will deliver opening remarks. There will be 21 white papers delivered during the three-day event on artificial intelligence, 3D printing and other highly technical topics. Presentations will range from 'Gold in the Age of SLM-CNC Interface,' and 'Cracks, pores and other defects in jewellery – their causes and their prevention' to 'Potential of Pt-and-pd-based Bulk Metallic Glasses for Jewellery applications.' It is fitting that it's established the Italian gold jewelry center of Vicenza, known as much for the technology of goldsmithing and jewelry making as well as it is for manufacturing jewels in the tradition of Italian design and style. FEATURED | Frase ByForbes™ Unscramble The Anagram To Reveal The Phrase Pinpoint By Linkedin Guess The Category Queens By Linkedin Crown Each Region Crossclimb By Linkedin Unlock A Trivia Ladder Familiar Names at Vicenzaoro When Vicenzaoro opens September 5 at the IEG's Expo Centre, it will once again be a showplace for internationally known Italian jewelry brands such as Roberto Coin, Annamaria Cammilli, Damiani, Nanis, Fope and Crivelli. The revival of the historic Marina B jewelry brand will also be a focus of the show. The fair attracts important jewelers from Europe and other parts of the world as well including Schreiner Fine Jewellery from Germany, Fabergé from the UK, Etho Maria from Greece, Carrera Y Carrera from Spain, and Statement Paris and D1928 from France. Outside Europe, the Australian pearl jewelry company, Autore, will present its new high jewelry and fine jewelry designs. One of the returning features of Vicenzaoro is 'The Design Room,' for independent high-end designers. This is one of the very few international venues where these designers can have a proper place to show their creations as most international jewelry shows focus on large manufacturers. These designers reinterpret jewelry with unique and exclusive creations. Among the best-known names are Alessio Boschi, whose creations combine culture, history and architecture; Mike Joseph, who focuses of geometric design studded with diamonds; Antonini Milano for lovers of pure yet structured lines; and Karen Suen who combines modern glam with classic jewelry techniques. In addition, there's 'The 8' project, a creation of Boschi, fellow jewelry designers Alessia Crivelli and Luca Daverio, and the goldsmith foundation, Mani Intelligenti. The project promotes new Italian and international jewelry talents. There's also a specific space for the watchmaking brands and accessories, a growing sector of the trade fair with more than 40 exhibitors. All totaled the September Vicenzaoro jewelry trade fair is expected to attract more than 450 buyers from 60 countries who will view the products and services of approximately 1,200 exhibitors from 35 countries. In its 70th year, Vicenzaoro claims to be the world's longest-running jewelry trade event. Vicenzaoro is held twice each year. Following the September show the next fair will be held January 16 – 20, 2026. Vicenzaoro and the Vicenza Symposium is owned and operated by the Italian Exhibition Group (IEG), an international trade show company based in Rimini, Italy.
Yahoo
17 minutes ago
- Yahoo
Cyberpunk 2 associate game director admits CD Projekt Red "are sometimes slower" than players would like, and yeah, I'd already made peace with the fact we'll be waiting on this sequel for years
When you buy through links on our articles, Future and its syndication partners may earn a commission. Cyberpunk 2077 quest design director Paweł Sasko admits that "we are sometimes slower [than] you would like" as the delayed Patch 2.3 finally goes live. The new update for Cyberpunk, which adds new vehicles, gameplay options, bug fixes and quality of life improvements, was originally planned for release on June 26, 2025, but wound up being pushed back to July 17 when developer CD Projekt Red announced on social media that "we'll need some more time to make sure we're happy with it". With Patch 2.3 now finally going live, Sasko, who's also associate game director on the upcoming Cyberpunk 2077 sequel, tells fans to "enjoy" the update as he says: "Everything we do, is for you. We are sometimes slower [than] you would like to [sic], but we always have the best of our community and our game in heart." Despite the apologetic tone, it seems as though the community has been perfectly happy to wait for the end result. Early initial reactions to Patch 2.3 seem positive, and even the original announcement that it was being rescheduled back in June was largely met with understanding and patience by the fanbase. That might be due to the fact that it's generally understood that game development is taking longer and longer with every passing year, an issue that's by no means exclusive to CDPR. As graphics and technology get more complicated and the scale of many projects increases, the time and resources needed to create these games is only getting greater, not helped by some studios jumping the gun and announcing projects way in advance of their actual release. To hammer that point home, The Elder Scrolls 6 was announced back in 2018, and there's no reason to think it'll be out any time soon. But of course, that community patience could always be because CDPR specifically has learned its lesson about rushed development. Cyberpunk's launch in 2020 was notorious for its poor performance and missing features, particularly on consoles, as well as brutal levels of crunch being reported in the months leading up to the game's release date. Consequently, the fanbase seems happy for the company to pace itself and its workload, considering the ugly consequences of what happened when it didn't. I fully agree with them on that score. Still, Sasko's comment is a reminder that good things come to those who wait, and a momentary glimpse into the priorities of a CD Projekt Red that appears to have learned its lesson. I guess with current industry trends and timescales in mind, I look forward to playing the Cyberpunk sequel sometime around the actual year 2077. Despite a rough start, Cyberpunk 2077 would eventually make it up to our list of the best RPGs! Check out what else made the list – and what took the first place spot.
Yahoo
2 hours ago
- Yahoo
ASML: Limited China Risk, Leading-Edge Exposure Could Drive Outperformance
ASML Holding N.V. (NASDAQ:ASML) is one of the . On July 24, New Street Research upgraded the stock to 'Buy' with a €790 price target driven by ASML's strong positioning for 2026 and the potential to outpace peers in the semiconductor capital equipment space. According to New Street, consensus estimates of 2% growth for next year are 'conservative.' They believe that there is 'room for ASML to outperform, driven by high leading-edge exposure.' The company stands to benefit from 'higher growth in leading-edge WFE spending and limited risk of share loss in China,' the firm noted, which would eventually result in growth in the 'upper end of its peer group.' The firm further cited that normal order intake in quarter 3 would allow ASML to ease concerns around growth for 2026. The stock is currently below both its historical averages and peers, but there is limited risk of further de-rating. A technician operating a robotic arm on a production line of semiconductor chips. Moreover, while it remains unclear how much spending will be done on wafer fab equipment, a broader pullback can be expected next year. ASML Holding N.V. (NASDAQ:ASML) develops and sells advanced semiconductor equipment, including lithography, metrology, and inspection systems for chip manufacturing. While we acknowledge the potential of ASML as an investment, we believe certain AI stocks offer greater upside potential and carry less downside risk. If you're looking for an extremely undervalued AI stock that also stands to benefit significantly from Trump-era tariffs and the onshoring trend, see our free report on the best short-term AI stock. READ NEXT: and . Disclosure: None.