Improper authentication in Apple AirPods
Priority LOW 22CWE-287Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00842 58th percentileScored 2026-11-07
Fix Fixed AirPods (Apple): unknown
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | AirPods | before unknown | unknown | Patch available | CNA |
- AirPods VendorApple Affected before unknown Fixed in unknown Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:apple:airpods_firmware:*:*:*:*:*:*:*:* | before 6a326 | Vulnerable | Apple |
| cpe:2.3:h:apple:airpods:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:apple:powerbeats_firmware:*:*:*:*:*:*:*:* | before 6f8 | Vulnerable | Apple |
| cpe:2.3:h:apple:powerbeats:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:apple:airpods_pro_firmware:*:*:*:*:*:*:*:* | before 6f8 | Vulnerable | Apple |
| cpe:2.3:h:apple:airpods_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:apple:beats_fit_pro_firmware:*:*:*:*:*:*:*:* | before 6f8 | Vulnerable | Apple |
| cpe:2.3:h:apple:beats_fit_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:apple:airpods_max_firmware:*:*:*:*:*:*:*:* | before 6f8 | Vulnerable | Apple |
| cpe:2.3:h:apple:airpods_max:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
- cpe:2.3:o:apple:airpods_firmware:*:*:*:*:*:*:*:* Versions before 6a326 Vulnerable ·Apple
- cpe:2.3:h:apple:airpods:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:apple:powerbeats_firmware:*:*:*:*:*:*:*:* Versions before 6f8 Vulnerable ·Apple
- cpe:2.3:h:apple:powerbeats:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:apple:airpods_pro_firmware:*:*:*:*:*:*:*:* Versions before 6f8 Vulnerable ·Apple
- cpe:2.3:h:apple:airpods_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:apple:beats_fit_pro_firmware:*:*:*:*:*:*:*:* Versions before 6f8 Vulnerable ·Apple
- cpe:2.3:h:apple:beats_fit_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:apple:airpods_max_firmware:*:*:*:*:*:*:*:* Versions before 6f8 Vulnerable ·Apple
- cpe:2.3:h:apple:airpods_max:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
Remediation
- Fix · CNA AirPods (Apple) Fixed in unknown
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27867
- 2026-10-03 Alias added: GHSA-hjp4-5jqf-9vgq
References
More Apple Airpods Firmware vulnerabilities
- TI-2023-12554 Authentication bypass by spoofing in Apple AirPods Firmware Update E CVSS 3.1MEDIUM 5.4
Sources
- CVE-2024-27867 · CVE Program
- CVE-2024-27867 · NVD
- FIRST EPSS
- GHSA-hjp4-5jqf-9vgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences