A flaw in the Bluetooth Low Energy implementation on Creative Sound Blaster Katana devices allows an attacker within range to connect to the device without prior pairing or authentication, thereby bypassing the intended access controls. This can give the attacker unauthorized control over the device, potentially enabling the transmission of commands, eavesdropping, or other malicious actions that compromise both confidentiality and integrity of the device’s data.

The vulnerability affects Creative Labs’ Creative Sound Blaster Katana product line, specifically the V2, V2X, and SE models. No additional version granularity is supplied; all listed models are considered vulnerable.

The CVSS score of 4.3 indicates a moderate severity for the flaw. The exploit probability is unknown because EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a physical, proximity‑based Bluetooth connection, requiring the attacker to be within typical BLE range. While the attack surface is limited to a local environment, the potential impact remains significant for any user who relies on the device’s security or wishes to protect sensitive audio data.