Beats Studio Buds Bluetooth Flaw Let Attackers Eavesdrop

Apple has quietly pushed a firmware update for the Beats Studio Buds after researchers showed that anyone within Bluetooth range could silently switch the microphone on and listen in. The buds did not need to be paired with the attacker. They just had to be sitting in pairing mode, waiting for a phone to find them.

The flaw, now logged as CVE-2025-20701, lives in an Airoha system-on-a-chip used inside the earbuds. Dennis Heinze and Frieder Steinmetz of ERNW first disclosed it at the TROOPERS conference in Germany roughly a year ago, alongside two related bugs in the same chip.

What the bugs actually do

On their own, each issue is awkward. Chained together, they are something else entirely. The researchers demonstrated that an attacker in range could:

• Hijack the Bluetooth link without any pairing or authentication.
• Read and write the buds' RAM and flash memory.
• Issue Hands-Free Profile commands to whatever phone the buds were paired with.
• Pull contacts and call history out of the device.
• Place calls from the paired phone.

That last point is the one that turns a quirky hardware bug into a surveillance tool. Trigger a call to a number the attacker controls, and the earbuds become a live listening device on whoever is wearing them, or whoever is sitting near the desk they're charging on.

Who actually gets hit by something like this

The researchers were honest about the limits. You need to be physically close to the target, and you need the skill to pull the chain off. That puts it firmly in the bracket of tooling for going after specific people rather than something you'd see sprayed across the public. Journalists, executives, lawyers, anyone whose conversations are worth the effort of getting within a few metres of.

It is also a useful reminder that the threat model around personal devices has drifted. The phone in your pocket gets patched constantly. The earbuds, the smartwatch, the keyboard, the headset on your desk all run their own little operating systems on chips most people have never heard of, and they update on their own schedule, if at all.

The fix

Apple's patch arrives as Beats Firmware Update 1B211. It installs automatically when the buds are within range of a paired iPhone, iPad or Mac, so for most people there is nothing to do beyond using them as normal. To confirm it has landed, open Bluetooth settings on the paired device, tap the info button next to the headphones, and check the firmware version.

Worth doing, particularly if your buds spend most of their life sitting on a desk in pairing mode, looking for a partner that hasn't turned up yet.