Description
An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.
References (4)
Core 4
Core References
Mailing List
http://seclists.org/fulldisclosure/2024/Jul/2
Vendor Advisory
https://support.apple.com/en-us/HT214111
Vendor Advisory
https://support.apple.com/kb/HT214111
Scores
CVSS v3
4.3
EPSS
0.0008
EPSS Percentile
24.2%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-287
Status
published
Products (6)
Apple/AirPods
apple/airpods_firmware
< 6a326
apple/airpods_max_firmware
< 6f8
apple/airpods_pro_firmware
< 6f8
apple/beats_fit_pro_firmware
< 6f8
apple/powerbeats_firmware
< 6f8
Published
Jun 26, 2024
Tracked Since
Feb 18, 2026