CVE-2025-20701: CWE-863 Incorrect Authorization in Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AI Analysis
Technical Summary
This vulnerability (CWE-863) in the Airoha Bluetooth audio SDK permits an attacker to pair a Bluetooth audio device without the user's consent. Exploitation does not require user interaction or additional execution privileges, potentially allowing remote escalation of privilege. The affected products are the AB156x, AB157x, AB158x, and AB159x series. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.
Potential Impact
Successful exploitation can lead to unauthorized pairing of Bluetooth audio devices, resulting in remote escalation of privileges. This compromises confidentiality, integrity, and availability of the affected devices without requiring user interaction or additional privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when pairing Bluetooth devices and restrict Bluetooth connectivity to trusted devices only.
CVE-2025-20701: CWE-863 Incorrect Authorization in Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series
Description
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1
Score 8.8high
Affected software
Airoha Technology Corp.
AB156x, AB157x, AB158x, AB159x series
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-863) in the Airoha Bluetooth audio SDK permits an attacker to pair a Bluetooth audio device without the user's consent. Exploitation does not require user interaction or additional execution privileges, potentially allowing remote escalation of privilege. The affected products are the AB156x, AB157x, AB158x, and AB159x series. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.
Potential Impact
Successful exploitation can lead to unauthorized pairing of Bluetooth audio devices, resulting in remote escalation of privileges. This compromises confidentiality, integrity, and availability of the affected devices without requiring user interaction or additional privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when pairing Bluetooth devices and restrict Bluetooth connectivity to trusted devices only.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- MediaTek
- Date Reserved
- 2024-11-01T01:21:50.382Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://www.kb.cert.org/vuls/id/859658","vendor":"CERT"}]
Threat ID: 68905789ad5a09ad00def63f
Added to database: 08/04/2025, 06:47:37 UTC
Last enriched: 08/08/2026, 13:30:46 UTC
Last updated: 09/10/2026, 19:46:21 UTC
Views: 223
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.