Security · November 6, 2026
Also published in Italiano, Español, Français, Português (Brasil)
Vulnerabilities Found in Wireless Barcode Scanners
Kaspersky has discovered a new cyber attack vector in wireless barcode scanners commonly used in logistics warehouses and retail. The research findings were revealed at the Security Analyst Summit 2026 held in Bali.
Modern logistics warehouses operate within a digital ecosystem where various devices and systems are closely interconnected. The Kaspersky security service research team investigated several attack vectors to identify potential risks within warehouse infrastructure. They found a vulnerability where there is no authentication procedure between specific barcode scanner base stations from major manufacturers and the scanners themselves.
Typically, handheld scanners communicate with base stations, which then connect to work PCs. The researchers demonstrated that an attacker within the wireless communication range could eavesdrop on Bluetooth traffic to discover the base station address and send a malicious payload mimicking keyboard input. The connected PC recognizes this input as legitimate user commands, allowing the attacker to attempt remote code execution.
If this attack is successful, the attacker can establish an initial foothold on the warehouse's internal computers. These computers are trusted devices connected to critical systems, providing an entry point into the operational technology network. The researchers warned that the same vulnerability could be exploited in other warehouse devices like handheld data terminals or thermal printers to gain access to Warehouse Management Systems (WMS).
A Kaspersky representative stated that the logistics and retail sectors must enhance security across all operational layers and ensure that new devices are validated before being connected to the network, while unused Bluetooth interfaces should be disabled. They also advised segmenting warehouse networks, applying security updates to devices and WMS immediately, and conducting regular simulations of attack vectors.