Kaspersky reports barcode scanner flaw allowing Bluetooth keystroke injection

What happened

According to ETCISO, Kaspersky says its researchers found an attack vector in a widely used barcode scanner model from a “major manufacturer”. Kaspersky presented the findings at the Security Analyst Summit 2026 in Bali, as part of a security audit of a warehouse environment.

Kaspersky reports that in a typical setup, handheld scanners talk to a base station, which connects to a workstation or other business system. The company says the main weakness is that there is no authentication between the base station and the scanners (ETCISO).

Kaspersky describes the following hypothetical attack, as reported by ETCISO:

• An attacker within wireless range obtains the base station’s Bluetooth address, for example by passively eavesdropping on Bluetooth traffic.
• The attacker sends a payload to the base station that simulates keyboard keystrokes.
• The base station forwards the keystrokes to the connected PC. The PC treats them as legitimate user input, which may be used to run unauthorized commands.

Kaspersky says an attacker could inject keystrokes and potentially achieve remote code execution without user interaction, gaining an initial foothold on a computer inside the warehouse network. The company says this attack pattern was observed across devices from multiple vendors. It also says similar scenarios might apply to other warehouse devices, such as portable data terminals or thermal printers, to reach systems like Warehouse Management Systems.

Not confirmed:

• The manufacturer and the scanner model are not named in the report.
• No CVE identifier is given.
• No vendor statement or patch is reported.
• The report does not mention any exploitation in the wild.
• There is no independent verification beyond Kaspersky’s own research.

Am I affected?

• Products: Not confirmed. The report does not name the vendor, model or firmware versions.
• Setups described: Kaspersky says the risk applies to wireless handheld scanners communicating with a base station over Bluetooth, where the base station is connected to a PC or business system (ETCISO).
• Sectors: Kaspersky names warehousing and retail, and says such devices are also used in multiple other sectors.

What to do now

These steps are Kaspersky’s recommendations as reported by ETCISO:

1. Disable any unused Bluetooth interfaces, and enforce strong authentication mechanisms.
2. Segment warehouse networks so that only essential connections are permitted.
3. Verify every new device before it connects to the network.
4. Apply security updates promptly to both devices and the WMS.
5. Restrict account permissions to the minimum required.
6. Run full-scale attack-path exercises regularly, including scenarios involving insiders with legitimate credentials.

Sources

• ETCISO: Kaspersky identifies vulnerabilities in barcode scanners, posing potential threat for the warehouse industry