Over-the-air BadUSB can hack Katana V2X

i also find this one fascinating for similar reasons:

1. "trivial" vuln (BT connection has same privs as USB) with everything else supporting that in a great writeup
2. vendor doesn't give a hoot & wont respond