Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone

A critical Bluetooth pairing vulnerability in Skullcandy Dime 3 (model S2DCW) firmware 1.0.0.28 lets nearby attackers silently pair with the earbuds without owner interaction (no PIN/passkey or pairing mode), persist as trusted devices, hijack A2DP audio streams, and access microphone audio via hands-free/headset profiles; the issue is linked to CVE-2025-20701 in the Airoha Bluetooth audio SDK and a patched firmware (1.0.0.30) exists but cannot currently be installed by consumers through the Skullcandy app, leaving affected users exposed in public or shared spaces.