Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds

In a recent security update, Apple has addressed a critical vulnerability in its Beats Studio Buds wireless earbuds that posed a significant risk of eavesdropping. This flaw, identified as CVE-2025-20701, was linked to improper authentication within the firmware of the Bluetooth chips, allowing potential attackers within range to impersonate previously paired devices. Researchers revealed alarming scenarios where this vulnerability could be exploited, enabling unauthorized users to listen in on conversations or sounds captured by the phone's microphone. Apple issued a security advisory on Tuesday, cautioning that an individual within Bluetooth range might intercept audio from a device that is not yet paired but actively seeking connection requests. The resolution for this issue is included in the Beats Firmware Update 1B211, which is automatically installed when the earbuds are connected to a compatible iPhone, iPad, or Mac within Bluetooth range. Users can verify their firmware version by accessing the Settings on their devices, navigating to Bluetooth, and tapping the information button next to their headphones. CVE-2025-20701 has been assigned a severity score of 8.8 out of 10, making it a significant threat. It was one of three vulnerabilities disclosed last year by security researchers Dennis Heinze and Frieder Steinmetz from Insinuator, related to chips manufactured by Airoha Systems. In response to these findings, Airoha had previously released an updated software development kit for affected hardware vendors. Apple's timely patch for the Beats Studio Buds coincided with similar announcements from Jabra, another headphone maker that also released updates. Further reinforcing the industry’s commitment to user security, manufacturers Bose and JBL have reported that their devices have been updated to incorporate necessary fixes as well.