Skullcandy's Dime 3 earbuds pair silently with any Bluetooth device in range

Pairing is the entire attack. A radio in range asks, and a Dime 3 on firmware 1.0.0.28 answers yes without a PIN, without access to the charging case, and without a prompt on the owner's phone ^[2]. The bond then sticks. The attacker's device is trusted from that point and reconnects on its own whenever it comes back into range, which is what turns a proximity trick into standing access to the headset profile and live microphone audio ^[5].

Skullcandy's fix exists. It is firmware 1.0.0.30 ^[6], and it reaches units that ship with it. CERT/CC's advisory is explicit about the rest: "As of this writing, there are no known consumer-accessible methods to update an existing unit from the affected firmware version 1.0.0.28 to version 1.0.0.30" ^[7]. For a pair already in someone's pocket, that leaves replacement or leaving them powered off as the only controls ^[1].

Airoha published SDK updates on August 4, 2025, and earbud manufacturers took them up afterwards ^[8]. The underlying defect is a missing-authentication problem that affects earbud and headphone products from multiple vendors, not just this model ^[4]; ERNW researchers found it and presented it at the TROOPER conference last year ^[9]. Apple shipped a firmware update for its Beats Studio Buds in June ^[10]. The defect traces to the same SDK across vendors; what separates a closed case from an open one is firmware delivery, not diagnosis ^[2].

The wearer's only cue is a "new device paired" notification after the rogue bond is already made, which CERT/CC expects to be missed or read as a brief dropout and reconnection ^[12]. CERT/CC picked up the Skullcandy case from a tip by researcher Jacob Nowak ^[11]. Neither the advisory nor the coverage puts a number on how many Dime 3 units are in circulation on 1.0.0.28; the product sits at the cheap end of the market and, per BleepingComputer, is popular with young buyers ^[14]. Skullcandy has not accounted publicly for the gap, and BleepingComputer reported it could not reach the company because its chatbot does not handle press requests ^[13].

That is the whole evidence base. It is a consumer advisory. It carries no serial-number or date-code mapping, so an owner holding a Dime 3 cannot tell from the box which firmware is inside. Until a service or app path for 1.0.0.28 appears, the controls available are physical: distance and the power state of the earbuds.