🕵️ RESEARCH & DEEP DIVES
- Pwnd Blaster: Creative Katana V2X speaker flaws allow covert spying and BadUSB attacks
Unauthenticated Bluetooth access to Creative Katana V2X speakers lets nearby attackers flash custom firmware, turning the speaker into a spying device and Rubber Ducky.- Affects Creative Sound Blaster Katana V2X speakers; Katana V2 has been tested vulnerable and Katana SE is likely also affected.
- Anyone within ~15m can connect over Bluetooth without pairing and send CTP commands, since the internal CTP handler is bridged to both USB and BLE.
- Firmware updates lack signature verification — only a trivially patchable SHA-256 checksum — so attackers can flash modified firmware over the air (~10 minutes via BLE).
- Malicious firmware could enable the speaker's microphone for covert audio monitoring or emulate a USB Rubber Ducky for keystroke injection.
- BLE characteristics involved: write 9e9daaec-3a10-4fe8-b69f-7397aff77886, read 9e9daaeb-3a10-4fe8-b69f-7397aff77886; CTP commands start with byte 0x5a.
📋 ADVISORIES
- 📄 Source for Handlebars.java path traversal (CVE-2026-103088) fixed in 4.5.5 — github.com