The handheld barcode scanner a picker uses hundreds of times a shift can be an entry point into a warehouse network, and an attacker may not need to set foot inside the building to use it.
That is one of the findings in a new paper from Kaspersky Security Services researchers Sergey Sidorov, Haidar Kabibo and Victor Zvarykin, which follows a single order through a modern warehouse to map where it can be attacked. Their argument is that a fulfilment centre is no longer a building with shelves but one interconnected system of web applications, radio links and factory automation, in which bad data has physical consequences.
Radio reaches the parking lot
Warehouses run on wireless. Wi-Fi carries handhelds, tablets, printers and cameras; Bluetooth serves scanners, headsets and beacons; Zigbee and LoRaWAN run sensors and building automation. Radio passes through gates and thin wall panels, so the researchers warn the network may be reachable from the parking lot. It also carries live control traffic: if hundreds of handhelds drop off at once, picking stops.
Scanners and label printers that accept commands
The team describes two concrete device findings from customer engagements and test stands.
- Barcode scanners. Because a scanner acts as a keyboard for the host it is connected to, a maliciously crafted barcode or QR code can inject keystrokes when scanned. Separately, testing a scanner's wireless link, the researchers found an attacker within range could inject keystrokes into the connected host and potentially achieve remote code execution without user interaction. They say the pattern appeared across multiple vendors, including Honeywell devices affected by CVE-2026-4272, which Kaspersky details in its advisory. The paper does not publish a CVSS score for it.
- Mobile thermal printers. On the Zebra ZQ630, which can run applications on the device, the researchers found that apps could be uploaded and executed over Bluetooth. By exploiting a pairing misconfiguration, an attacker in Bluetooth range could bypass pairing, upload malicious software and gain a foothold through the printer.
The paper also flags portable data terminals, which are Android devices locked into a single app in kiosk mode. Escaping that kiosk can expose the Wi-Fi password or allow remote-access software to be installed, and the terminal already holds authenticated access to the warehouse management system (WMS) by design.
Why the management system is the prize
Every device in that chain talks to the WMS, which Kaspersky calls the operating system of the warehouse. The researchers cite CVE-2026-70774 in Oracle Warehouse Management, part of Oracle E-Business Suite, which Oracle rated High and described as an easily exploitable authorization bypass letting a low-privileged attacker with network access create, delete or modify critical data. In a warehouse, they note, that means stock levels, bin locations, picking tasks and shipments can be silently falsified, and because each stage trusts the record from the one before, one bad entry spreads downstream. Where the WMS drives conveyors, sorters and lifts through PLCs, the impact can reach physical machinery. Kaspersky points to the UNFI 10-K disclosure of unauthorized activity that hit order fulfilment as an example of the stakes, and the sector is already in extortion crews' sights, as one gang's sweep of 38 port and shipping firms showed.
Segment the floor, patch the devices, survey the air
The researchers recommend separating corporate IT, warehouse OT, operational devices and management networks, isolating each site and customer integration, and enforcing switch port security and IEEE 802.1X with EAP-TLS. Handhelds, scanners and printers should be brought into endpoint and patch management with accelerated fixes for critical bugs, radio-frequency surveys should map what is broadcasting and how far, and WMS platforms and their APIs should be on a defined patch cycle. Operators of Honeywell scanners and Zebra mobile printers should check their vendors' guidance for these issues.
The point the paper lands on is a useful one for anyone running logistics: the warehouse is now a single digital system with doors, motors and radios attached, and it fails like one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.