Domain Analysis: Cybersecurity and Wireless Protocol Exploitation
Expert Persona: Senior Security Researcher and Embedded Systems Exploitation Specialist.
Abstract:
This technical briefing details the discovery and exploitation of three critical vulnerabilities (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) within Bluetooth SoCs developed by Airoha, a major supplier for premium audio brands including Sony, Marshall, Jabra, and Beyerdynamic. The research identifies a proprietary, unauthenticated protocol named RACE (Remote Application Control Engine) that allows an attacker within Bluetooth range to perform arbitrary memory reads/writes and flash dumps without a pairing relationship.
The findings demonstrate a significant "pivoting" attack vector: by exploiting a vulnerable peripheral, an attacker can extract the Bluetooth Link Key— the shared cryptographic secret between the headset and a smartphone. This allows the attacker to impersonate the headset to the smartphone using the Hands-Free Profile (HFP). Demonstrated impacts include the unauthorized interception of phone numbers, manipulation of voice assistants (Siri), and full account takeovers (WhatsApp/Amazon) by hijacking voice-based 2FA verification calls.
Exploiting Airoha-Based Bluetooth Peripherals: Technical Summary
0:44 Research Origin: The study began with an investigation into the "Auracast" broadcast feature, leading to the discovery of a common Taiwanese SoC vendor, Airoha, used in both low-end and high-end audio devices.
4:13 Discovery of Custom Protocols: Initial analysis of USB HID traffic revealed a non-encrypted vendor protocol used for firmware updates and configuration. Commands were identified for writing (0x402) and reading (0x403) flash memory.
9:37 Airoha Market Ubiquity: Teardowns confirmed Airoha SoCs are prevalent in premium brands such as Sony (WH/WF-1000XM series), Marshall, Jabra, and Bose, as well as the AirPod "clone" market.
13:58 The "RACE" Protocol: Reverse engineering of vendor Android apps identified the "RACE" protocol (Remote Application Control Engine). It operates over Bluetooth Classic (RFCOMM) and BLE (GATT) and provides deep access to the SoC's internal state.
18:01 Authentication Failure: A critical vulnerability exists where the RACE protocol does not require an established pairing or bonding relationship. Any device in range can connect to the headset and issue RACE commands.
21:01 SoC Capabilities: Demonstrated capabilities include dumping flash memory partitions (NVDM), reading/writing RAM, and querying the device's internal Bluetooth address and firmware build versions.
25:03 Real-Time Eavesdropping: Using RAM read commands, researchers demonstrated the ability to extract live "Media Info" (metadata of the current song playing) and establish silent audio connections for eavesdropping.
31:30 The Pivot (Link Key Theft): The most severe impact involves dumping the NVDM partition to steal the Bluetooth Link Key. This key is the basis of trust between the phone and the headset.
36:20 Headset Impersonation: By spoofing the headset’s MAC address and utilizing the stolen Link Key, an attacker can connect to the target smartphone as the trusted peripheral, bypassing all pairing prompts.
38:57 HFP Exploitation and 2FA Bypass: Using the Hands-Free Profile (HFP) on the impersonated connection, the researchers successfully queried the victim’s phone number and triggered a "call me" verification for WhatsApp. By "spamming" the HFP accept-call command, the attacker intercepted the 2FA code silently, enabling full account takeover.
47:35 Vulnerability Disclosure: Three CVEs were assigned. While Airoha responded quickly with SDK patches, downstream vendors (notably Sony) were less transparent, and many devices remained unpatched months after the report.
53:42 Tooling Release: The researchers released a toolkit for fingerprinting vulnerable devices and performing technical audits, emphasizing that smartphones are increasingly hardened, shifting the attack surface to "trusted" but insecure peripherals.