Loading story…
Security researcher Rasmus Moorats disclosed multiple flaws in the Creative Sound Blaster Katana V2X that allow an attacker within roughly 15 meters to remotely alter the speaker over Bluetooth Low Energy without pairing or physical access. The attack chain relies on the device exposing its proprietary Creative Transport Protocol over BLE without authentication and accepting firmware images based only on a CHK2 SHA-256 checksum field, with no cryptographic signature verification. Moorats showed that an attacker can push modified firmware to the soundbar over the air while preserving normal speaker functionality.
The proof of concept turned the USB-connected soundbar into a BadUSB-style device that re-enumerates as a keyboard and injects keystrokes into a connected PC, and also demonstrated the potential to use the speaker as a covert audio surveillance device. Creative reportedly took weeks to respond and said it did not consider the issue a cybersecurity risk, leaving no official patch available at publication time. As a partial mitigation, Moorats released an unofficial tool that patches the official firmware over USB to disable CTP over Bluetooth, though it may break the mobile app and does not address the underlying lack of firmware authenticity controls.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-02, Creative released firmware version 1.21.260630.1200 for Sound Blaster Katana devices, adding checks for appended bytes after CHK3 and limiting section parsing to payload_size. According to the researcher, these changes are sufficient to prevent the demonstrated firmware-signature bypass, while fixes for Bluetooth CTP authentication are still pending.
The researcher released an unofficial patching tool that disables CTP-over-Bluetooth by patching and reflashing the official firmware over USB. The mitigation reduces exposure but may break the mobile app and does not fully address the underlying design weaknesses.
On 2026-06-03, a researcher publicly disclosed multiple vulnerabilities in the Creative Sound Blaster Katana V2X that allow unauthenticated attackers within about 15 meters to modify firmware over Bluetooth without pairing or physical access. The disclosure showed the device could be turned into a covert microphone and a USB HID "Rubber Ducky" that injects keystrokes into a connected PC.
The researcher reported the Sound Blaster Katana V2X vulnerabilities to Creative through support channels and via SingCERT. Creative later responded that it did not consider the issue a cybersecurity risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
blog.nns.ee
Open sourcetomshardware.com
Open sourceblog.nns.ee
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed three vulnerabilities in Bluetooth audio devices built on Airoha systems-on-chip that can allow an attacker within radio range to gain unauthorized access to device memory and communications. The flaws, tracked as **`CVE-2025-20700`**, **`CVE-2025-20701`**, and **`CVE-2025-20702`**, stem from missing authentication in GATT and Bluetooth BR/EDR components and weak permission controls in a proprietary protocol, affecting headphones and earbuds sold by brands including **Sony, Bose, Jabra, JBL, Marshall, Beyerdynamic, and Teufel**. ERNW researchers said the bugs can be chained to hijack the Bluetooth link between a phone and an audio device, issue commands to the paired phone through the **Hands-Free Profile**, eavesdrop on conversations, and potentially overwrite firmware for remote code execution on the accessory. The attack requires proximity because exploitation is limited by Bluetooth range, but defenders were urged to apply vendor firmware updates and investigate or restart devices showing abnormal Bluetooth behavior.
Jul 24, 2026
Security researchers have identified and disclosed several critical vulnerabilities in Bluetooth headphones and earbuds powered by Airoha Bluetooth System-on-Chips (SoCs), which are widely used by major brands such as Sony, Bose, JBL, Marshall, and Jabra. The vulnerabilities, tracked as CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, allow attackers within Bluetooth range to eavesdrop on conversations, steal sensitive data, and potentially hijack connected smartphones. The most severe flaw, related to the RACE (Remote Access Control Engine) protocol, enables remote code execution and arbitrary memory access due to missing authentication mechanisms in both Bluetooth Low Energy and Classic modes. Despite initial disclosure in June 2025 and the availability of patches, many affected devices remain unpatched, increasing the risk of exploitation. The RACE protocol, originally designed for factory debugging and firmware updates, is exposed over multiple interfaces, including Bluetooth and USB HID, providing attackers with powerful capabilities if exploited. Researchers have released a white paper and the RACE Toolkit to help users and security professionals assess device vulnerability. The ongoing exposure of these flaws highlights the importance of timely patching and the risks associated with insecure default configurations in widely deployed consumer electronics. Users of affected headphones and earbuds are urged to check for firmware updates and apply patches as soon as possible to mitigate the risk of compromise.
Jun 29, 2026
A newly disclosed vulnerability, **CVE-2026-18411**, affects Acrisure **KARR BT** and **DR-100** automotive anti-theft systems by using a shared hard-coded Bluetooth authentication key across devices. The flaw, classified as **CWE-321**, allows an attacker within Bluetooth range to send unauthorized commands without prior privileges or user interaction, creating a direct path to compromise protected vehicle functions. Security reporting and government advisories warn that successful exploitation could let an attacker unlock doors and interfere with engine immobilization on affected vehicles. The issue carries a **CVSS v3.1** score reflecting high integrity and availability impact (`AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`), and has been referenced by both a **CISA ICS advisory** and a **CERT-PY** notice covering the Bluetooth product vulnerability.
Aug 8, 2026