ERNW White Paper 74

ERNW White Paper 74 documents critical vulnerabilities in Airoha-based Bluetooth headphones and earbuds: an unauthenticated proprietary RACE protocol (exposed via USB HID, RFCOMM, and GATT) and missing Bluetooth authentication for BLE and BR/EDR. The RACE commands permit arbitrary flash and RAM read/write, enabling firmware extraction, Link Key theft, remote code injection, microphone/audio hijacking, and impersonation of trusted peripherals to compromise paired phones; the authors provide PoC tooling, disclosure timeline, affected-device survey, mitigations, and three CVEs (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702).