Creative Sound Blaster Katana V2X Bluetooth Flaw Lets Hackers Type Commands

A security researcher demonstrated a critical flaw in the Creative Sound Blaster Katana V2X gaming soundbar that allows attackers to hijack the device over Bluetooth without pairing. The exploit works from approximately 16 yards away and bypasses standard authentication protocols. This vulnerability lets an attacker flash custom firmware onto the soundbar, which then acts as a keyboard to type commands directly into the connected host PC.

Researcher demonstrates unauthenticated Bluetooth exploit that bypasses pairing requirements and allows remote command injection into host PCs.

The flaw targets the unauthenticated Bluetooth interface on the Katana V2X model. Creative refused to classify this security gap as a cybersecurity risk and has not released an official patch for owners. The company maintains that the issue does not present a genuine threat to user safety or data integrity.

Researcher Rasmus Moorats identified the root cause in the device's firmware architecture. He noted that the absence of firmware signing allows anyone with Bluetooth access to overwrite the stock software. Once flashed, the modified firmware transforms the USB-connected soundbar into an input device that executes arbitrary commands on the host system.

Moorats released a utility designed to patch the CTP-over-Bluetooth vulnerability. This tool likely breaks compatibility with Creative's mobile application and requires users to reflash the firmware via USB connection. The workaround addresses the immediate attack surface but leaves the underlying design flaw uncorrected by the manufacturer.

Creative positions the Katana V2X as a gaming peripheral aimed at desktop users who connect soundbars directly to their PCs. The company declined to label the Bluetooth exploit a security vulnerability despite the clear risk of unauthorized command injection. Owners currently lack an official firmware update to resolve the issue.

This incident underscores the ongoing debate over how hardware makers should handle vulnerability disclosures and update obligations when working with independent security experts. Creative's refusal to acknowledge the flaw as a cybersecurity risk leaves users without vendor-backed protection. Moorats' workaround provides a temporary fix but does not address the fundamental design oversight in the Bluetooth stack.