Creative Katana V2X soundbar can be turned into a remote BadUSB over Bluetooth

Security researcher nns reverse-engineered the Creative Sound Blaster Katana V2X and found a chain of weaknesses that lets anyone within roughly 15 meters fully compromise the speaker without pairing or physical access. The device’s proprietary Creative Transport Protocol (CTP) requires challenge-response authentication over USB, but the same command handler is exposed over Bluetooth Low Energy with no authentication at all — a BLE connection alone is enough to send any CTP command, including reading device state and pushing firmware updates.

Firmware images are protected only by a SHA-256 checksum at the end of the container, with no signature verification. The researcher patched a firmware to display ‘PATCHED’ on the front panel to prove the point, then wrote a Python script that flashes arbitrary firmware over BLE in about ten minutes. Because the soundbar is normally USB-attached to a PC and contains a microphone, a malicious image can turn it into either a covert listening device or a remote Rubber Ducky that injects keystrokes into the trusted host.

The takeaway is a familiar one: bolting BLE onto a USB peripheral without re-applying the device’s existing authentication, and shipping firmware updates with only an integrity check rather than a signature, collapses the trust boundary between a nearby attacker and the victim’s PC. Any Katana V2X in range becomes a wireless attack surface against the machine it is plugged into.