CVE-2025-20700: High severity Airoha Bluetooth audio SDK vulnerability
In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Bluetooth LE GATT service that exposes the RACE protocol, or configure the SDK/device to enforce authentication and authorization so only trusted, authenticated peers can access the RACE GATT characteristics.
Airoha Bluetooth audio SDK (Bluetooth LE GATT service for RACE protocol) GATT service access control = disable or require authenticated/authorized connections - Compensating control
If disabling or patching the SDK is not immediately possible, use device management/endpoint controls to restrict Bluetooth LE connectivity to trusted devices only (block unknown pairings), or disable Bluetooth LE entirely on affected devices until a fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20700?
CVE-2025-20700 is considered a high-severity vulnerability due to its potential for remote escalation of privilege.
How do I fix CVE-2025-20700?
To address CVE-2025-20700, update to the latest version of the Airoha Bluetooth audio SDK that contains the security patches.
What kind of data is accessible due to CVE-2025-20700?
CVE-2025-20700 allows unauthorized access to critical data related to the RACE protocol through Bluetooth LE GATT service.
Does CVE-2025-20700 require user interaction for exploitation?
No, CVE-2025-20700 can be exploited without any user interaction.
What systems are affected by CVE-2025-20700?
The Airoha Bluetooth audio SDK is the affected software for CVE-2025-20700.