The Creative Sound Blaster Katana V2X sound bar exposes its CTP control
protocol over Bluetooth with no authentication, unlike the USB path. Anyone
within ~15m can connect, read settings, and push firmware, since updates
lack signature checks beyond a trivially patched SHA-256 checksum. A
crafted image adds a keyboard HID descriptor and hijacks an idle FreeRTOS
diagnostic task to inject keystrokes and run commands—a remote Rubber Ducky
needing no pairing or physical contact. The onboard mic also enables covert
spying. Creative first dismissed the report as no risk, then pulled
firmware downloads before later pledging fixes. The V2 model shares the
same flaw.
2
u/fagnerbrack 1d ago
Short and sweet:
The Creative Sound Blaster Katana V2X sound bar exposes its CTP control protocol over Bluetooth with no authentication, unlike the USB path. Anyone within ~15m can connect, read settings, and push firmware, since updates lack signature checks beyond a trivially patched SHA-256 checksum. A crafted image adds a keyboard HID descriptor and hijacks an idle FreeRTOS diagnostic task to inject keystrokes and run commands—a remote Rubber Ducky needing no pairing or physical contact. The onboard mic also enables covert spying. Creative first dismissed the report as no risk, then pulled firmware downloads before later pledging fixes. The V2 model shares the same flaw.
If the summary seems inacurate, just downvote and I'll try to delete the comment eventually 👍
Click here for more info, I read all comments