Hacking your PC using your speaker without ever touching it

A security researcher discovered critical vulnerabilities in the Creative Sound Blaster Katana V2X speaker that allow attackers within Bluetooth range (~15m) to control the device without pairing or physical access. By exploiting an unauthenticated Bluetooth protocol used for device management and firmware updates, an attacker can upload malicious firmware to the speaker, potentially turning it into a covert spying tool or Rubber Ducky. The flaws stem from improper authentication and firmware protection, enabling over-the-air firmware flashing via Bluetooth. This raises significant security concerns as the speaker's microphone could be misused for surveillance.