A researcher has shown that a USB-connected speaker can be turned into a remote attack proxy, letting someone within Bluetooth range infect a PC without ever touching the machine. The finding centers on Creative Technologies’ Sound Blaster Katana V2X, a $283 speaker that can connect to computers over USB or Bluetooth and, according to the research, expose more functionality than users would expect.
A Bluetooth speaker that can talk to a PC
The discovery came from researcher Rasmus Moorats, who said he stumbled onto the issue after buying a Katana V2X and trying to build a Linux tool that could communicate with it. That led him to a proprietary mechanism he believes stands for Creative Transport Protocol, or CTP. According to Moorats’ findings, CTP lets devices connected over Bluetooth or USB send commands to the speaker, including controls for LED colors and equalizer settings, while also receiving responses back from the device.
The unexpected part was that a Bluetooth device could communicate with a Katana V2X that was already connected to a PC over USB, and do so without authentication. Moorats also found he did not need to pair the Bluetooth device first. That made the speaker behave less like a simple accessory and more like a bridge between a nearby attacker and the attached computer.
Firmware replacement without code signing
One of the CTP commands was labeled “upload new firmware to device,” and Moorats found it would accept a replacement firmware image. In the report, he said the reflashing process did not use code signing or similar protections to block unofficial code. He was able to replace the speaker’s firmware with a custom image that did little more than display the word “patched” on the speaker’s LED display.
That capability is significant because it means an attacker who can reach the speaker over Bluetooth may be able to take control of the device itself before using it as a path into the host computer. In a real-world scenario, that could let an intruder persist on the speaker and keep a foothold even after the connected PC is restarted.
Turning a speaker into a keyboard
Moorats then looked at the FreeRTOS-based firmware running on the Katana V2X and found support for Human Interface Device, or HID, functions. HID is the category that includes peripherals such as keyboards, mice, and webcams. The speaker’s implementation was limited at first, allowing things like volume changes and play or pause controls.
But he discovered he could alter the USB descriptor set, the information a peripheral presents to tell other devices what it can do. By adding a second descriptor that reported the speaker as a keyboard, he was able to reuse code already in the firmware to send keystrokes more efficiently. That is the step that turns the speaker from an audio device into a keyboard-like input source.
He then chained the pieces together: a Bluetooth-connected device could send commands to the speaker, the speaker could accept and flash custom firmware, and the modified firmware could emulate keyboard input to the attached PC. In Moorats’ words, “Chaining it all together, I was able to totally remotely, over the air, upload a custom firmware to my speaker which I hadn’t paired with, which would reboot, flash the custom firmware, and after rebooting type in the command echo pwned and execute it.”
What a real attack could look like
Moorats said that in a practical attack, the typed command would likely do much more than print a harmless message. He wrote that a real attacker would probably open PowerShell or a similar tool and paste a malicious one-liner into it. He also suggested that an attacker could disable the routine used to update firmware in both normal and recovery mode, making it difficult or impossible for a victim to remove the malicious firmware or patch the device later.
Another concern is that Bluetooth appears to remain enabled on the speaker even in sleep mode, with no obvious way to turn it off. That widens the window for abuse because the attack surface stays available even when the device is not actively in use.
Authentication was present, but not much of a barrier
Before the speaker and a USB-connected device can interact, they must complete a challenge-and-response authentication procedure. In practice, Moorats found that the handshake happens automatically each time the software boots, so it does not usually stop an attacker. In some situations, such as when the Katana V2X app is not open on the connected device, the check becomes necessary.
Even then, Moorats said the hurdle is weak because the correct response can be extracted from the app binary bundled with the speaker. He also noted that no equivalent challenge-and-response was required for Bluetooth-connected devices, which further simplified the attack path.
Vendor response and practical limits
Moorats said he reported the issue to Creative Technologies but did not receive a response. He then involved CERT Singapore, which eventually obtained a reply from the company. According to the report, Creative engineers did not consider the behavior a vulnerability. Moorats tested the attack against a connected Windows machine.
The attack is not remote in the internet sense. The attacker still has to be within Bluetooth range of the speaker, which limits exposure to neighbors, housemates, or people in nearby offices. But within that range, the device can become a “PC-pwning proxy” and, as Moorats demonstrated, a remote bugging device as well.
That makes the case notable not just because of one speaker model, but because it highlights a broader risk: other Bluetooth peripherals may also create unexpected bridges between nearby attackers and connected computers.
Source: Original report
Was this helpful?
Last Modified: July 7, 2026 at 9:30 pm
3 views
