Xiaomi’s Redmi Buds series faces critical security flaws that enable attackers to steal sensitive call data and crash devices without authentication.
Two newly disclosed vulnerabilities affect Redmi Buds 3 Pro through 6 Pro, allowing unauthenticated adversaries within Bluetooth range to access private phone numbers and trigger repeated denial of service conditions.
The vulnerabilities stem from improper handling of RFCOMM protocol mechanisms in the earbuds’ firmware. RFCOMM is a Bluetooth protocol layer that manages serial communication between paired devices.
Research from Carnegie Mellon University reveals that Redmi Buds maintain undocumented L2CAP and RFCOMM channels beyond the advertised Bluetooth profiles Hands-Free Profile (HFP), Advanced Audio Distribution Profile (A2DP), and Audio/Video Remote Control Profile (AVRCP) likely for legacy audio support or auxiliary services.
Critical Information Disclosure Flaw
CVE-2025-13834 exploits flawed bounds checking in the device’s RFCOMM TEST command handler.
When the control channel receives a TEST command with an inflated length field but empty payload, the faulty response mechanism returns uninitialized memory buffers containing up to 127 bytes of sensitive data.
Attackers can extract phone numbers of active call peers with a single packet, repeatedly triggering the flaw without user awareness.
The vulnerability closely mirrors the infamous Heartbleed bug (CVE-2014-0160), as both result from blind trust in packet length fields without adequate validation.
This memory disclosure represents a fundamental oversight in the earbuds’ firmware architecture and demonstrates how IoT protocol stacks remain susceptible to classical buffer over-read attacks.
CVE-2025-13328 describes a flooding vulnerability affecting RFCOMM channels.
Attackers can overwhelm the device’s processing queue by flooding the control channel with high-volume TEST commands or targeting Modem Status Command (MSC) signaling frames across HFP channels and undocumented Airoha auxiliary service channels.
Resource exhaustion triggers firmware crashes that forcibly disconnect all paired devices, requiring physical reset via the charging case for recovery.
Both vulnerabilities require no prior pairing, authentication, or user interaction. Attackers need only obtain the target device’s MAC address through basic Bluetooth scanning tools.
Exploitation range extends approximately twenty meters with standard equipment and no signal amplification, though physical barriers and Bluetooth version variations affect effective distance.
| CVE ID | Vulnerability Type | Attack Vector | Impact |
|---|---|---|---|
| CVE-2025-13834 | Information Leak | RFCOMM TEST Command | Call data exposure, phone number theft |
| CVE-2025-13328 | Denial of Service | RFCOMM Flooding | Firmware crash, forced disconnection |
Xiaomi has not responded to requests regarding remediation or mitigation strategies. No firmware patches are currently available.
Users should disable Bluetooth when earbuds are unused, particularly in public environments where attackers could exploit these flaws.
The vulnerabilities were discovered by researchers Choongin Lee, Jiwoong Ryu, and Heejo Lee, with documentation provided by the CERT Coordination Center.
These flaws highlight ongoing security challenges in consumer IoT devices where protocol implementations lack rigorous validation mechanisms.
Follow us on Google News, LinkedIn, and X to Get Instant Updates ancd Set GBH as a Preferred Source in Google.
