Every time you flip open the lid of a pair of wireless earbuds, a few hundred milliseconds pass before your phone reclaims them. That sliver of time is a room left unlocked, according to ERNW’s research on the Beats Studio Buds.
The race nobody notices
When the case opens, the earbuds wake and wait for a known device to reconnect. During that gap they accept a pairing request from anyone, with no confirmation prompt and no passcode. A nearby attacker who tries a Bluetooth Classic connection at the right moment wins the race, because low-energy discovery is comparatively sluggish.
One win lasts forever
The pairing becomes a bond, so the intruder stays authenticated and can return whenever they like. It could pull the identity resolving key and follow its owner for months with a sniffer, or open a live audio channel and listen through the microphone.
The Beats were meant to be immune
ERNW’s earlier Bluetooth audio work targeted Airoha chipsets and their RACE protocol. The Studio Buds carry MediaTek silicon that ignores RACE entirely, so those bugs did not apply. The pairing window was a separate defect.
What the window means for earbuds
Apple shipped Beats Firmware Update 1B211 on June 16, mapping the repair to CVE-2025-20701, months after ERNW submitted the write-up in November 2025. Apple calls the underlying code open source, which ERNW disputes because the relevant SDK is proprietary. Only the Studio Buds are named; AirPods use a different chipset.
Accessory firmware now sits inside the security perimeter. A phone with every patch installed still hands a microphone to whoever wins a race at an open case. Owners should confirm firmware 1B211 or later, and treat an unfamiliar device in their Bluetooth list as reason to unpair everything and start fresh.
Source: ERNW Insinuator
