Kaspersky maps warehouse attack paths: radio, scanner and printer entry points, and WMS compromise
Kaspersky Security Services published a threat-model paper on how attackers can compromise modern logistics warehouses. It follows an order through eight fulfillment stages: unloading, receiving, putaway, storage, picking, sorting, packing and shipment. The paper identifies the warehouse management system (WMS) as the highest-value target, because it is the system of record that coordinates IT, OT, robotics and PLCs. It cites recent disruptions at Morrisons, United Natural Foods (UNFI) and CEVA Logistics (eight European warehouses, with customer delivery data exposed) as examples of the business impact. Kaspersky's research also found initial access paths through proximity-based radio attacks, barcode scanners, PDTs and mobile thermal printers.
Technical Details
- Threat actors modeled: remote external, proximate external (for example, in a parking lot) and internal (employees, contractors).
- Radio channels: Wi-Fi, Bluetooth, Zigbee, LoRaWAN and cellular can be reached from outside the building, giving a foothold or disrupting availability (for example, halting AGVs or handhelds).
- Physical access: unsupervised network jacks, cameras and access points in large racked warehouses expose live, often unsegmented, network ports.
- Barcode scanners: a malicious barcode can inject keystrokes into the host. In a customer engagement, Kaspersky found that wireless keystroke injection from within range could potentially lead to RCE without user interaction. The pattern was seen across vendors, including Honeywell devices affected by CVE-2026-4272.
- PDTs: escaping Android kiosk mode can expose the Wi-Fi password or allow installation of remote-access software.
- Mobile thermal printers: on the Zebra ZQ630, a Bluetooth pairing misconfiguration lets a nearby attacker bypass pairing, upload and run malicious apps, and gain a foothold.
- WMS: CVE-2026-70774 in Oracle Warehouse Management (Oracle E-Business Suite) is an authorization bypass rated High. A low-privileged user with network access can create, modify or delete critical data, affecting integrity and availability. Chaining it with RCE or SQL injection could allow fabricated shipment orders, waybills and transfer records.
- Impact: integrity is the most critical property, since falsified records propagate down the eight-stage dependency chain and can become physical or safety incidents. Ransomware and availability loss are also highlighted.
Remediation
The excerpt does not give detailed recommendations, though the paper says it closes with advice on where the key controls sit. It stresses assessing all interconnected systems (IT, OT, radio, cloud, building systems) as attack paths rather than relying on a single vulnerability scanner. Defenders should apply the vendor fixes for the cited CVEs and ensure network segmentation and physical oversight of warehouse infrastructure.
Linha do tempo
-
Kaspersky maps warehouse attack paths: radio, scanner and printer entry points, and WMS compromise
ler a análise desta fonte ocultar
Kaspersky Security Services published a threat-model paper on how attackers can compromise modern logistics warehouses. It follows an order through eight fulfillment stages: unloading, receiving, putaway, storage, picking, sorting, packing and shipment. The paper identifies the warehouse management system (WMS) as the highest-value target, because it is the system of record that coordinates IT, OT, robotics and PLCs. It cites recent disruptions at Morrisons, United Natural Foods (UNFI) and CEVA Logistics (eight European warehouses, with customer delivery data exposed) as examples of the business impact. Kaspersky's research also found initial access paths through proximity-based radio attacks, barcode scanners, PDTs and mobile thermal printers.
Technical Details
- Threat actors modeled: remote external, proximate external (for example, in a parking lot) and internal (employees, contractors).
- Radio channels: Wi-Fi, Bluetooth, Zigbee, LoRaWAN and cellular can be reached from outside the building, giving a foothold or disrupting availability (for example, halting AGVs or handhelds).
- Physical access: unsupervised network jacks, cameras and access points in large racked warehouses expose live, often unsegmented, network ports.
- Barcode scanners: a malicious barcode can inject keystrokes into the host. In a customer engagement, Kaspersky found that wireless keystroke injection from within range could potentially lead to RCE without user interaction. The pattern was seen across vendors, including Honeywell devices affected by CVE-2026-4272.
- PDTs: escaping Android kiosk mode can expose the Wi-Fi password or allow installation of remote-access software.
- Mobile thermal printers: on the Zebra ZQ630, a Bluetooth pairing misconfiguration lets a nearby attacker bypass pairing, upload and run malicious apps, and gain a foothold.
- WMS: CVE-2026-70774 in Oracle Warehouse Management (Oracle E-Business Suite) is an authorization bypass rated High. A low-privileged user with network access can create, modify or delete critical data, affecting integrity and availability. Chaining it with RCE or SQL injection could allow fabricated shipment orders, waybills and transfer records.
- Impact: integrity is the most critical property, since falsified records propagate down the eight-stage dependency chain and can become physical or safety incidents. Ransomware and availability loss are also highlighted.
Remediation
The excerpt does not give detailed recommendations, though the paper says it closes with advice on where the key controls sit. It stresses assessing all interconnected systems (IT, OT, radio, cloud, building systems) as attack paths rather than relying on a single vulnerability scanner. Defenders should apply the vendor fixes for the cited CVEs and ensure network segmentation and physical oversight of warehouse infrastructure.