CVE-2025-20702

Think of a Bluetooth device like a building with locked doors and internal “service” rules. This bug may let someone bypass those internal rules for the device’s RACE protocol, effectively upgrading their access level inside the device. The concerning part is that an attacker may be able to do this remotely, without needing extra capabilities or user actions from you.

This matters to you if your company uses or sells devices built with the Airoha Bluetooth audio SDK, especially products using the Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series, or AB1627. It’s not described as something that affects general desktop or office software; it’s tied to specific Bluetooth audio SDK/device lines from Airoha. If you don’t use these specific device lines, you may not be affected, but you should confirm with your hardware vendor.

This is an AMBER-level issue: it’s high impact and remote, but the situation is not fully “confirmed weaponized” in public. There is a proof-of-concept reported (“poc_public”), but there’s no known public exploit, no CISA KEV entry, and no Nuclei detection template, which suggests attackers may still be limited or evolving. Because it’s a patch-related resurfacing and the flaw can be triggered remotely without user interaction, you should prioritize updates in the near term.

1. Identify affected inventory: Make a list of all Bluetooth audio devices you operate (and versions/firmware if known). Confirm with the manufacturer whether they use the Airoha Bluetooth audio SDK and whether they correspond to Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series, or AB1627.

2. Obtain the remediation: Request from the vendor the firmware/SDK update that fixes CVE-2025-20702. Apply it following the vendor’s update procedure (or schedule it via your IT/OT maintenance window).

3. Validate after update: After updating, confirm the device firmware version matches the vendor’s “fixed” release notes (or obtain written confirmation from the vendor if you can’t directly verify).

4. Mitigate while waiting (if patch isn’t immediately available):

• Reduce Bluetooth exposure in your environment (e.g., restrict pairing/availability, limit where devices are discoverable, and disable Bluetooth features you don’t need).
• Apply any vendor-provided mitigations related to RACE protocol handling, if offered.

5. Monitor and respond: Since the issue involves remote escalation of privilege and user interaction is not required, be alert for abnormal device behavior after updates (unexpected reboots, loss of audio service, unusual pairing/session patterns). Use any vendor monitoring tools or logging available.

6. Reassess risk: Re-check your exposure once patches land, especially for devices deployed in public-facing locations where attackers could attempt Bluetooth connections repeatedly.

Severity/impact: The CVSS score is 8.8 (HIGH). The flaw is described as a possible unauthorized access to the RACE protocol in the Airoha Bluetooth audio SDK, which could enable remote escalation of privilege without needing additional execution privileges.

Exploitation status: Press attention notes “resurfacing” and “patch,” and exploitation status is described as “poc_public.” There is no known CISA KEV listing and no public exploit available (as provided), and no Nuclei detection template exists.

Attack vector: Remote exploitation over the device’s RACE protocol path related to Bluetooth audio functionality; no user interaction is required.

EPSS/KEV meaning in this context: EPSS is given as 4.0%, an estimate of the likelihood of exploitation in the next 30 days. CISA KEV indicates widely recognized, actively exploited vulnerabilities; here it is “no,” meaning it is not on that list based on the provided information.