Apple patches Beats Studio Buds Bluetooth security flaw

Apple has released a critical firmware update for Beats Studio Buds to patch a security vulnerability that could have allowed nearby attackers to eavesdrop on users. The flaw, identified as CVE-2025-20701, enabled someone within Bluetooth range to listen through the earbuds' microphone when the device was not yet paired and actively seeking a connection.

The company issued the patch, Beats Firmware Update 1B211, on June 16, 2026. In a security advisory, Apple explained the vulnerability stems from a flaw in open-source code and that its software was among the affected projects. The update is delivered automatically to earbuds when they are placed in their charging case, connected to power, and within Bluetooth range of a paired iPhone, iPad, or Mac. Users can verify their earbuds have been updated by navigating to Bluetooth settings on their paired device and confirming the firmware version reads 1B211.

The security gap was discovered and reported to Apple by researchers Dennis Heinze and Frieder Steinmetz of ERNW GmbH. According to their analysis, the weakness is a missing authentication flaw in the Bluetooth BR/EDR radio standard. They demonstrated a proof-of-concept exploit...