Nintendo discloses Switch security vulnerability: scan the code to run code or obtain console information

Abstract:

Nintendo released a new security bulletin today, disclosing a security vulnerability affecting the Switch console. This vulnerability can allow third parties to run unauthorized code on the user's host through close-range and remote attacks, or obtain some information stored in the host.

According to Nintendo, the attack methods are relatively limited. Malicious third parties must directly scan the QR code displayed on the Switch console screen (or TV screen)

If the QR code is not scanned, the user will not be affected. Once the QR code is scanned, it is possible for others to run unauthorized code on the user's Switch console or obtain information stored on the console.

Nintendo confirmed that those affected are Switch consoles with system firmware versions lower than 23.0.0. At the same time, this vulnerability cannot be used to obtain console information on Nintendo Switch2.

Nintendo proposed the following preventive measures in the announcement:

First, please update your console to the latest system version (23.0.0). Users can select "System Settings" > "System" in the HOME menu to view the current system version, and they can also update it here.

If you cannot update to the latest version immediately, Nintendo recommends that users pay attention to the following points:

When using the "Send to Smartphone" function in the photo album, or using karts to play "Mario Kart Live: Home Tour", please ensure that the environment is such that third parties cannot scan the QR code displayed on the console screen (or TV screen).

In addition, when using the "send to smartphone" function in the photo album, avoid using a smartphone that is not your own; when playing "Mario Kart Live: Home Tour", also avoid using a kart that is not your own.

Nintendo has previously pushed a major update to version 23.0.0 on Nintendo Switch2, adding many new features.

Related articles:

Nintendo Switch 2 firmware 23.0.0 update is online, host mode VRR is officially unlocked