Kaspersky experts have discovered a new cyber-attack vector via a widely used barcode scanner model that could expose e-commerce supply chains to cyberattacks. The findings, presented at the Security Analyst Summit 2026 in Bali, are part of a security audit of a warehouse digital ecosystem.
Modern warehouses are far more than simple storage spaces, they constitute complex ecosystems built upon multiple technologies and devices. With global e-commerce sales nearly doubling since 2019 to over $6 trillion, any disruption or delay in the delivery chain can result in massive financial and reputational losses. To identify possible risks Kaspersky Security Services researchers have examined multiple cyber-attack vectors on warehouse infrastructure, including attacks conducted using various devices in warehouse systems, and have found a new attack vector exploiting a vulnerability in a barcode scanner model from a major manufacturer. Such devices are widely used in warehousing, retail, and multiple other sectors.
A typical setup has handheld scanners communicating with a base station, which is in turn connected to a workstation or another business system. The main weak point is that there is no authentication between the base station and the scanners.
Kaspersky research reveals that these scanners might serve as an entry point into the warehouse OT network. The attack could be conducted through the scanner’s wireless link. Kaspersky researchers found that an attacker within range could inject keystrokes into the connected device and potentially achieve remote code execution without requiring user interaction.
In a hypothetical attack, a user may be carrying out their normal
daily work using a wireless barcode scanner connected to a base station, while
an attacker obtains the Bluetooth address of the base station, for example,
through passive eavesdropping on Bluetooth traffic. Through the established
Bluetooth connection, the attacker sends a malicious payload to the base
station, simulating keyboard keystrokes. The base station forwards these
keystrokes to the connected PC, where they are interpreted as legitimate user
input and may be used to execute unauthorized commands. This attack pattern was
observed across devices from multiple vendors.
As a result, the attacker could gain an initial foothold on a computer within the warehouse network. The scanner serves only as the entry point. The significance of this foothold lies in the computer’s trusted position within the operational environment and its connectivity to critical systems. These attack vectors may pose a significant threat not only to the warehouse industry but also to the retail sector and any other domain where such devices are actively used.
Kaspersky researches believe that the same attack scenarios might be used for other warehouse devices like Portable Data Terminals (PDR) or thermal printers to gain access to infrastructure, such as Warehouse Management Systems (WMS).
“Modern retail and logistics are profoundly digital, from enterprise-wide management platforms down to every device in a worker’s hands. This pervasive connectivity means that any technology at any tier can become an entry point for a cyberattack capable of destabilizing the entire ecosystem — as our research shows, even a single barcode scanner. The warehouse sector, and the broader retail industry, should treat cybersecurity as a top priority across every layer of their operations,” said Sergey Sidorov, Head of Industrial Security Services at Kaspersky.
To enhance security in warehouse environments, Kaspersky experts recommend verifying every new device before it connects to the network, disabling any unused Bluetooth interfaces and enforce strong authentication mechanisms, segmenting warehouse networks so that only essential connections are permitted, promptly applying security updates to both devices and the WMS, while restricting account permissions to the minimum required, and regularly conduct full‑scale attack‑path exercises that include scenarios involving insiders with legitimate credentials.
Kaspersky offers a comprehensive assessment of industrial environments: uncovering weaknesses in ICS, OT, and networked devices, evaluating configurations and access paths, and mapping vulnerabilities to reveal actionable risks. By assessing systems on-site, Kaspersky ICS Security Assessment uncovers hidden risks and delivers actionable insights without disrupting operations.
These measures can be reinforced with purpose-built solutions such as Kaspersky Industrial Cyber Security (KICS), designed to protect industrial organizations, including logistics companies. The platform helps enhance visibility across the corporate infrastructure and strengthen cybersecurity without disrupting operations or compromising system availability.
Read the full security audit of the warehouse digital ecosystem on the Securelist.com.
About Kaspersky Security Services
Renowned for delivering Security Services globally, the team goes
beyond customer engagements, uncovering new TTPs, enriching the MITRE
ATT&CK framework, developing proprietary tools and enhancing detection
capabilities in Kaspersky products. They also share their expertise through
webinars, reports and training to help professionals stay ahead of threats.
