Kaspersky Security Services researchers have uncovered a new attack vector targeting warehouses by exploiting a vulnerability in a widely used barcode scanner model, potentially exposing warehouse and e-commerce operations to cyberattacks.
Key Takeaways
- Kaspersky Security Services has discovered a new attack vector in a widely used barcode scanner model that could let attackers gain remote code execution without user interaction.
- The flaw stems from a lack of authentication between the scanner and its base station, letting a nearby attacker inject keystrokes over the wireless link.
- The research, presented at the Security Analyst Summit 2026 in Bali, found the same attack pattern across devices from multiple vendors.
The findings, presented at the Security Analyst Summit 2026 in Bali, are part of a security audit of a warehouse digital ecosystem by Kaspersky. With global e-commerce sales having nearly doubled since 2019 to more than US$6 trillion, researchers say any disruption to the delivery chain can cause significant financial and reputational damage.
No Authentication Between Scanner and Base Station
A typical warehouse setup has handheld scanners communicating with a base station, which is in turn connected to a workstation or another business system. Kaspersky found the main weak point is that there is no authentication between the base station and the scanners, meaning the devices can serve as an entry point into the warehouse operational technology network.
In a hypothetical attack scenario, an attacker within Bluetooth range could obtain the base station’s Bluetooth address through passive eavesdropping, then send a malicious payload simulating keyboard keystrokes. The base station forwards these to the connected PC, where they are interpreted as legitimate user input and could be used to execute unauthorised commands, gaining an initial foothold on a computer with a trusted position in the operational environment.
A Single Scanner as the Entry Point
“Modern retail and logistics are profoundly digital, from enterprise-wide management platforms down to every device in a worker’s hands. This pervasive connectivity means that any technology at any tier can become an entry point for a cyberattack capable of destabilising the entire ecosystem – as our research shows, even a single barcode scanner,” said Sergey Sidorov, Head of Industrial Security Services at Kaspersky.
Kaspersky researchers believe similar attack scenarios could apply to other warehouse devices, including portable data terminals and thermal printers, as a way to gain access to broader infrastructure such as warehouse management systems.
Closing the Gap Across Every Device Tier
To reduce exposure, Kaspersky recommends verifying every new device before it connects to the network, disabling unused Bluetooth interfaces and enforcing strong authentication, segmenting warehouse networks so only essential connections are permitted, promptly patching both devices and the warehouse management system, restricting account permissions to the minimum required, and regularly running full-scale attack-path exercises, including scenarios involving insiders with legitimate credentials.
