CVE-2024-27867: When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones in Apple AirPods
CVE-2024-27867 is a low-severity Bluetooth authentication vulnerability affecting Apple AirPods and Beats headphones. When the headphones are attempting to connect to a previously paired device, an attacker within Bluetooth range could spoof the intended device and gain unauthorized access to the headphones. Apple addressed this issue by improving state management in the authentication process. The vulnerability is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8, which are automatically delivered to devices paired and in Bluetooth range of an Apple device.
AI Analysis
Technical Summary
This vulnerability involves an authentication issue in Apple AirPods and Beats headphones during the connection request phase to previously paired devices. An attacker in Bluetooth range might spoof the source device to gain access to the headphones. Apple resolved the issue by enhancing state management in the authentication mechanism. The fix is included in firmware updates 6A326, 6F8 for AirPods, and 6F8 for Beats headphones. Firmware updates are automatically applied when the headphones are paired and within Bluetooth range of an iPhone, iPad, or Mac.
Potential Impact
An attacker within Bluetooth range could spoof a previously paired device and gain unauthorized access to the affected headphones. The impact is limited to potential unauthorized access to the headphones themselves. There is no indication of confidentiality, integrity, or user data compromise beyond this access. The CVSS score is 3.3 (low severity), reflecting limited impact and the requirement for physical proximity.
Mitigation Recommendations
Apple has released firmware updates (6A326, 6F8) for AirPods and Beats headphones that address this vulnerability. These updates are automatically delivered when the headphones are paired and within Bluetooth range of an Apple device. Users should ensure their headphones are updated to the latest firmware version by keeping them paired and in range of their iPhone, iPad, or Mac. No additional user action is required beyond applying the firmware update.
CVE-2024-27867: When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones in Apple AirPods
Description
CVE-2024-27867 is a low-severity Bluetooth authentication vulnerability affecting Apple AirPods and Beats headphones. When the headphones are attempting to connect to a previously paired device, an attacker within Bluetooth range could spoof the intended device and gain unauthorized access to the headphones. Apple addressed this issue by improving state management in the authentication process. The vulnerability is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8, which are automatically delivered to devices paired and in Bluetooth range of an Apple device.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an authentication issue in Apple AirPods and Beats headphones during the connection request phase to previously paired devices. An attacker in Bluetooth range might spoof the source device to gain access to the headphones. Apple resolved the issue by enhancing state management in the authentication mechanism. The fix is included in firmware updates 6A326, 6F8 for AirPods, and 6F8 for Beats headphones. Firmware updates are automatically applied when the headphones are paired and within Bluetooth range of an iPhone, iPad, or Mac.
Potential Impact
An attacker within Bluetooth range could spoof a previously paired device and gain unauthorized access to the affected headphones. The impact is limited to potential unauthorized access to the headphones themselves. There is no indication of confidentiality, integrity, or user data compromise beyond this access. The CVSS score is 3.3 (low severity), reflecting limited impact and the requirement for physical proximity.
Mitigation Recommendations
Apple has released firmware updates (6A326, 6F8) for AirPods and Beats headphones that address this vulnerability. These updates are automatically delivered when the headphones are paired and within Bluetooth range of an Apple device. Users should ensure their headphones are updated to the latest firmware version by keeping them paired and in range of their iPhone, iPad, or Mac. No additional user action is required beyond applying the firmware update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apple
- Date Reserved
- 2024-02-26T15:32:28.541Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69ceb827e6bfc5ba1df6e8e2
Added to database: 4/2/2026, 6:40:39 PM
Last enriched: 4/9/2026, 11:20:04 PM
Last updated: 5/20/2026, 8:57:22 PM
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.