Xiaomi’s Redmi Buds series faces critical security flaws that enable unauthenticated attackers to steal sensitive call data and crash devices without user interaction.
Two newly disclosed vulnerabilities affect Redmi Buds 3 Pro through 6 Pro, allowing adversaries within Bluetooth range to access private phone numbers and trigger repeated denial-of-service conditions.
Protocol-Level Vulnerabilities
The vulnerabilities stem from improper handling of RFCOMM protocol mechanisms in the earbuds’ firmware.
RFCOMM is a Bluetooth protocol layer managing serial communication between paired devices.
Research from Carnegie Mellon University reveals that Redmi Buds maintain undocumented L2CAP and RFCOMM channels beyond the advertised Bluetooth profiles Hands-Free Profile (HFP), Advanced Audio Distribution Profile (A2DP), and Audio/Video Remote Control Profile (AVRCP)—likely for legacy audio support or auxiliary services.
CVE-2025-13834 exploits a bounds-checking flaw in the device’s RFCOMM TEST command handler. When the control channel receives a TEST command with an inflated length field but an empty payload, the faulty response mechanism returns uninitialized memory buffers containing up to 127 bytes of sensitive data.
Attackers can extract the phone numbers of active call peers with a single packet, repeatedly triggering the flaw without the user’s awareness.
This vulnerability closely mirrors the infamous Heartbleed bug (CVE-2014-0160), as both result from blind trust in packet length fields without adequate validation.
This memory disclosure represents a fundamental oversight in the earbuds’ firmware architecture, demonstrating how IoT protocol stacks remain susceptible to classical buffer over-read attacks.
CVE-2025-13328 describes a flooding vulnerability affecting RFCOMM channels. Attackers can overwhelm the device’s processing queue by flooding the control channel with high-volume TEST commands or targeting Modem Status Command (MSC) signaling frames across HFP channels and undocumented Airoha auxiliary service channels.
Resource exhaustion triggers firmware crashes that forcibly disconnect all paired devices, requiring a physical reset via the charging case for recovery.
Both vulnerabilities require no prior pairing, authentication, or user interaction. Attackers need only obtain the target device’s MAC address through basic Bluetooth scanning tools.
The exploitation range extends approximately 20 meters with standard equipment and no signal amplification, though physical barriers and Bluetooth version differences affect the effective range.
| CVE ID | Vulnerability Type | Attack Vector | Impact |
|---|---|---|---|
| CVE-2025-13834 | Information Leak | RFCOMM TEST Command | Call data exposure, phone number theft |
| CVE-2025-13328 | Denial of Service | RFCOMM Flooding | Firmware crash, forced disconnection |
Xiaomi has not responded to requests regarding remediation or mitigation strategies. No firmware patches are currently available.
Users should disable Bluetooth when earbuds are not in use, particularly in public environments where attackers could exploit these flaws.
The vulnerabilities were discovered by researchers Choongin Lee, Jiwoong Ryu, and Heejo Lee, with documentation provided by the CERT Coordination Center.
These flaws highlight ongoing security challenges in consumer IoT devices, where protocol implementations lack rigorous validation.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=Two newly disclosed vulnerabilities affect Redmi Buds 3 Pro through 6 Pro, allowing adversaries within Bluetooth range to access private phone numbers){kind=link}