8.8
/ 10
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Basic Information
ID
CVE-2025-20701
Source
MediaTek
Published
Aug 4, 2025 at 06:20
Modified
Aug 5, 2025 at 03:56
Affected Product
Vendor
Airoha Technology Corp.
Product
AB156x, AB157x, AB158x, AB159x series
Version
Airoha IoT SDK for BT audio v5.5.0 and earlier
Affected Versions
Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series Airoha IoT SDK for BT audio v5.5.0 and earlier
Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series Airoha AB1561x/AB1562x/AB1563x SDK v3.3.1 and earlier
Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series Airoha AB1561x/AB1562x/AB1563x SDK v3.3.1 and earlier