{"id":"CVE-2026-55981","kind":"vulnerability","aliases":["CVE-2026-55981"],"related":[],"title":"Creative Sound Blaster Katana: firmware check lets attackers install modified firmware","description":"A firmware verification vulnerability in Creative Sound\nBlaster Katana could allow an attacker to modify a legitimate firmware image\nand upload the modified firmware to an affected device.","summary":"Creative's Sound Blaster Katana speakers do not properly verify firmware images before accepting them. An attacker can alter a genuine firmware image and upload it to the device, which means persistent control of the speaker.","severity":"critical","cvss":9.6,"epss":0.00304,"exploited":false,"exploited_at":null,"products":[{"name":"Sound Blaster Katana V2/V2X","fixed":["1.30.260813.1100"],"affected":"< 1.30.260813.1100","ecosystem":"hardware"},{"name":"Sound Blaster Katana SE","fixed":["1.30.260813.1110"],"affected":"< 1.30.260813.1110","ecosystem":"hardware"}],"ecosystems":["hardware"],"tags":["audio-hardware","bluetooth","creative-sound-blaster-katana","firmware","infrastructure","usb"],"not_affected_if":["already-updated-firmware"],"how_to_check":"Compare the installed firmware version in the Creative app or device settings against the fixed versions listed for your model.","fix":"Update Sound Blaster Katana V2/V2X to 1.30.260813.1100 or later, and Katana SE to 1.30.260813.1110 or later.","status":"open","published_at":"2026-10-23T07:16:38+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:34+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:31:34Z","model":"claude-haiku-5-5","output":{"fix":"Update Sound Blaster Katana V2/V2X to 1.30.260813.1100 or later, and Katana SE to 1.30.260813.1110 or later.","reach":"unknown","title":"Creative Sound Blaster Katana: firmware check lets attackers install modified firmware","impact":"high","summary":"Creative's Sound Blaster Katana speakers do not properly verify firmware images before accepting them. An attacker can alter a genuine firmware image and upload it to the device, which means persistent control of the speaker.","category":"infrastructure","who_cares":["creative-sound-blaster-katana","firmware","bluetooth","usb"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gains persistent control of the device firmware.","analyst_note":"Sources do not say how the attacker reaches the upload path (USB, Bluetooth, or local network) or whether authentication is required; check the NVD entry and vendor advisory.","how_to_check":"Compare the installed firmware version in the Creative app or device settings against the fixed versions listed for your model.","needs_analyst":true,"not_affected_if":["already-updated-firmware"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000521,"input_tokens":3002,"output_tokens":442,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and Creative's vendor advisory for affected firmware versions, the update path, and whether the upload needs local USB access or network reach.","search":"'-2026':13A,16A '-55981':14A,17A 'accept':51B 'affect':100C 'allow':84C 'alter':56B 'attack':8A,54B,86C 'audio':27B 'audio-hardwar':26B 'blaster':3A,19A,23A,33B,41B,81C 'bluetooth':29B 'check':6A 'control':70B 'could':83C 'creativ':1A,31B,38B,79C 'creative-sound-blaster-katana':30B 'cve':12A,15A 'devic':66B,101C 'firmwar':5A,11A,35B,48B,59B,75C,91C,97C 'genuin':58B 'hardwar':28B 'imag':49B,60B,92C 'infrastructur':36B 'instal':9A 'katana':4A,20A,24A,34B,42B,82C 'legitim':90C 'let':7A 'mean':68B 'modifi':10A,88C,96C 'persist':69B 'proper':46B 'se':25A 'sound':2A,18A,22A,32B,40B,80C 'speaker':43B,73B 'upload':62B,94C 'usb':37B 'v2/v2x':21A 'verif':76C 'verifi':47B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T07:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-55981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55981","severity":null,"published_at":"2026-10-23T07:16:38+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-55981:180","url":null,"severity":null,"published_at":"2026-10-23T22:12:32+00:00","modified_at":"2026-10-23T22:12:32+00:00","first_seen_at":"2026-10-23T22:12:32+00:00","fetched_at":"2026-10-23T22:12:32+00:00","note":"Primary: CSA Singapore AL-2026-134 (affected 'prior to' 1.30.260813.1100/.1110, patched 2026-06-25, public 2026-08-27). Attack vector is adjacent (Bluetooth) or USB, not only local USB. PoC is in the nns.ee write-up, which targets the 1.20 build. NVD and CVE.org list 1.30.260813.1100 itself as affected, which conflicts with CSA and looks like a CNA wording error. I did not read Creative's KB pages (sid=201267 and 201271) and found no in-the-wild exploitation. I did not search social posts. Sibling: CVE-2026-63243 (BLE auth, medium)."},{"source":"epss","external_id":"CVE-2026-55981","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55981","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1326,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-134/","title":"CSA Singapore AL-2026-134: Creative Sound Blaster Katana","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1327,"url":"https://blog.nns.ee/2026/07/03/katana-badusb-fix/","title":"Bypassing the Sound Blaster's new firmware signature check (nns.ee)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1328,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55981","title":"NVD CVE-2026-55981","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}