Katana V2X Firmware Lacks Signature Checks on CTP Updates
Static-key CTP and checksum-only firmware updates in Katana V2X permit remote code execution via speaker hardware.
The Creative Sound Blaster Katana V2X accepts firmware images after verification of only a SHA-256 checksum appended as CHK2, per direct extraction of CTP traffic and container analysis at the source URL.
FBOOT and FMAIN binaries, both derived from FreeRTOS 8.2.3, implement identical CTP command paths with a static challenge-response key obtainable from app binaries, enabling unauthenticated command execution over USB.
Bluetooth stacks in the device extend unauthenticated CTP sessions to a 15 m range, permitting deployment of arbitrary payloads without pairing as documented in the firmware container structure.
AXIOM: Static authentication in consumer audio devices will recur as vendors reuse app-derived keys without hardware-backed verification.
Sources (2)
- [1]Primary Source(https://blog.nns.ee/2026/06/03/katana-badusb/)
- [2]Related Source(https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-nieh.pdf)