In brief: Security researchers found that some widely used wireless barcode scanners accept fake keystrokes from anyone in range, which could open a path into warehouse software.
Implications:
Scanners: Your Bluetooth scanner’s base station passes on whatever it receives as typing, without checking who sent it.
Vendor: Ask whether your base stations confirm which scanner is talking to them, since Kaspersky didn’t name the models.
Checks: Kaspersky recommends turning off unused Bluetooth and walling scanner PCs off from the rest of the network.
The News
Kaspersky researchers found a way into warehouse computer systems through wireless barcode scanners, the security company said at its Security Analyst Summit. The team discovered the gap during a security audit of a warehouse’s systems, in a scanner model from what it called a major manufacturer, and saw the same pattern in devices from several other vendors. It did not name the brands or say whether a fix is available.
In a typical setup, handheld scanners talk over Bluetooth to a base station, which plugs into a workstation and passes along each scan as if someone had typed it. The base station never checks that the signal comes from one of its own scanners, Kaspersky said. So an attacker within range could learn the base station’s Bluetooth address by listening to wireless traffic, then send it a payload that mimics keystrokes, which the PC would treat as a person typing commands.
Kaspersky said the same approach could work on other warehouse devices, such as portable data terminals and thermal label printers, and from there reach the warehouse management system (WMS). “This pervasive connectivity means that any technology at any tier can become an entry point for a cyberattack capable of destabilizing the entire ecosystem,” said Sergey Sidorov, head of Industrial Security Services at Kaspersky.
Kaspersky is a Russian company whose software the US Commerce Department banned from sale to US customers in 2024, so US sites can’t buy its security products. The weakness it describes sits in the scanners, not in Kaspersky’s software.
Why It Matters
The weak spot is a device on the floor: the PC trusts the scanner’s base station the way it trusts a keyboard, and that PC can be a step away from the WMS.
Trusted by default: Whatever the base station sends runs with the rights of whoever is logged in to that PC.
No list to check yet: Kaspersky didn’t name the models or a patch, so you can’t match your scanners against a list.
Range matters: The attacker has to be within Bluetooth range of the base station, so someone has to be near or inside the building.
What It Costs
None of the recent large attacks on distributors and retailers started with a barcode scanner, but they show what it costs when a building’s systems stop:
UNFI: A June 2025 cyberattack hit the grocery distributor’s ability to fill and ship orders, including to Whole Foods, and the company cut $350M to $400M from its expected sales.
Marks & Spencer: The UK retailer halted online orders after an attack in April 2025, and said it would lose about £300M in operating profit, partly from the waste and logistics costs of running by hand.
French grocers: Hackers took over refrigeration controllers at more than 250 French supermarkets this month and spoiled fresh and frozen stock, and Intermarché said its insurance doesn’t cover that kind of incident.
Who’s Exposed
The sites most exposed are those where Bluetooth handhelds pair with a base station plugged into a PC, especially a PC that stays logged in to the WMS. Kaspersky also flagged portable data terminals and thermal label printers as possible ways in.
Kaspersky recommends these steps:
Lock down Bluetooth: Disable Bluetooth on any device or PC that doesn’t need it, and enforce strong authentication.
Separate the network: Split warehouse networks so scanner PCs can reach only the systems they need.
Limit logins: Give the accounts on those PCs only the access the job needs.
