Barcode Scanners Lack Bluetooth Auth, Exposing Warehouses

How an unauthenticated Bluetooth link becomes a terminal shell

Industrial logistics environments run on handheld peripherals that workers rarely think twice about. A typical setup consists of a cordless scanner communicating over Bluetooth with a wired cradle, which plugs directly into a workstation via USB. That USB connection behaves as a Human Interface Device (HID), meaning the host computer unconditionally trusts whatever characters the cradle forwards.

Kaspersky researchers discovered that several models from major manufacturers skip mutual authentication entirely. By passively monitoring local radio traffic, a nearby attacker can sniff the base station's hardware address. Once captured, the attacker connects a rogue device to the cradle and transmits arbitrary keyboard inputs. Because the cradle assumes any paired radio traffic comes from its handheld trigger, it faithfully relays the keystrokes to the PC.

From there, the playbook looks identical to a BadUSB exploit. Attackers do not need physical access to the building's interior; they merely need radio range from a parking lot or delivery bay. The injected sequence can open command shells, download secondary payloads, and quietly establish remote access while warehouse staff continue scanning pallets.

From loading docks to critical supply chains

The peripheral itself is never the end goal. Once an attacker lands on an inventory PC, they can pivot into Warehouse Management Systems (WMS) and broader corporate directories. In poorly segmented networks, an operations terminal on a fulfillment floor often shares connectivity with accounting servers or cloud databases.

Much like how legacy protocol gaps such as the 16-year-old Broadcom Wi-Fi bug left edge hardware unprotected for over a decade, peripheral security on factory floors is routinely treated as an afterthought. Similar vulnerabilities extend to thermal label printers and portable data terminals commonly linked to central logistics engines.

Kaspersky declined to name the specific equipment vendors involved, but noted the design failure spans multiple brands. With more than 180,000 warehouses operating globally alongside hospitals and retail outlets that rely on identical barcode readers, the vulnerable footprint is vast.

Defensive steps for warehouse operators

Until manufacturers ship firmware that enforces encrypted pairing and certificate-backed handshakes, logistics operators must treat scanner docks as untrusted endpoints.

Enterprise security teams should enforce strict network access controls on floor terminals, isolating them in dedicated VLANs with zero access to core IT subnets. Operating systems should be configured to disable unapproved HID devices, block unauthorized script interpreters like PowerShell on floor-level accounts, and strip administrative rights from warehouse inventory logins.

• Disable unneeded Bluetooth discovery and interfaces on stationary docks.
• Lock down workstation operating systems to prevent arbitrary script execution from USB input devices.
• Isolate fulfillment floor systems onto dedicated subnets away from enterprise domains.
• Audit existing scanning hardware and press hardware vendors for signed firmware updates.

Availability and industry impact

The vulnerability affects legacy and current-generation Bluetooth barcode readers deployed across operations in North America, the UK, and Europe. Because Kaspersky has not publicly disclosed manufacturer names or model numbers, enterprise IT teams cannot rely on quick CVE patches.

Organizations running logistics, freight handling, or big-box retail should immediately review their physical-layer Bluetooth policies and inspect endpoint isolation on all loading dock computers.

The logistics sector handles trillions of dollars in goods every year, yet an unauthenticated wireless link in a $200 scanner can unravel that infrastructure. Closing this blind spot requires treating every warehouse peripheral with the same defensive rigor applied to public servers.