CVE-2025-20701 describes a security flaw in the Airoha Bluetooth audio SDK where an attacker can pair a Bluetooth audio device without the user's consent. This bypass of user interaction controls leads to remote escalation of privilege. The vulnerability does not require any additional execution privileges and can be exploited remotely. The CVSS 3.1 vector indicates the attack vector is adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data.

Successful exploitation allows an attacker to pair a Bluetooth audio device without user consent, resulting in remote escalation of privilege. This can compromise confidentiality, integrity, and availability of the affected system or device. No additional execution privileges or user interaction are needed, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users and administrators should monitor vendor communications for updates. No specific mitigations are provided in the available data.