Weak authentication in wireless scanners could allow attackers to inject keystrokes, execute unauthorised commands and gain an initial foothold in warehouse IT and operational technology environments.
Kaspersky researchers have identified a cyberattack vector involving widely used wireless barcode scanners that could expose warehouse networks to unauthorised access, potentially putting e-commerce supply chains, retail operations and logistics systems at risk.
Presented at the Security Analyst Summit 2026 in Bali, the findings emerged from a security assessment of a warehouse digital ecosystem. The research highlights how seemingly peripheral devices can become entry points into interconnected business and operational technology (OT) environments.
Modern warehouses rely on an extensive mix of scanners, workstations, warehouse management systems (WMS) and other connected technologies. With global e-commerce sales exceeding $6 trillion, disruptions to these operations can carry significant financial and reputational consequences.
“Even a single barcode scanner” can become an entry point for a cyberattack capable of destabilising an entire digital ecosystem. — Sergey Sidorov, Head of Industrial Security Services, Kaspersky
The vulnerability identified by Kaspersky concerns a wireless barcode scanner model in which authentication is absent between the handheld scanner and its base station. Researchers found that an attacker within wireless range could exploit the connection to inject keystrokes into a connected computer, potentially enabling remote code execution without user interaction. Similar attack patterns were observed across devices from multiple vendors.
In a hypothetical attack, an adversary could obtain the base station’s Bluetooth address by passively monitoring wireless traffic and establish a connection. The attacker could then transmit a malicious payload that simulates keyboard input. Because the base station forwards the keystrokes to the connected computer as legitimate input, the commands could be used to execute unauthorised actions.
The scanner itself is only the initial entry point. Once inside, an attacker could exploit the workstation’s trusted position and its connections to critical systems. Kaspersky researchers also warned that similar attack scenarios could affect other warehouse equipment, including portable data terminals and thermal printers, potentially opening pathways to WMS infrastructure.
“Modern retail and logistics are profoundly digital, from enterprise-wide management platforms down to every device in a worker’s hands,” said Sergey Sidorov, Head of Industrial Security Services at Kaspersky. He warned that connected technologies at any level could become an entry point capable of destabilising wider operations, making cybersecurity a priority across the entire supply chain.
Kaspersky recommends verifying devices before connecting them to corporate networks, disabling unused Bluetooth interfaces, enforcing strong authentication and segmenting warehouse networks to restrict unnecessary communications. Organisations should also apply security updates promptly, limit account permissions and conduct attack-path exercises that account for threats involving insiders with legitimate credentials.
The company offers Industrial Control Systems (ICS) security assessments to identify weaknesses in configurations, connected devices and access paths. Its Kaspersky Industrial Cyber Security platform is designed to improve visibility and strengthen protection across industrial and logistics environments without disrupting operations.
The findings underline a broader security challenge for digitally connected supply chains: protecting core enterprise systems is not enough if peripheral devices can provide an unguarded route into the network.
