--- title: "Nintendo warns of Switch QR code exploit – update to 23.0.0" url: "https://www.nintendoreporters.com/en/news/nintendo-switch-2/nintendo-warns-of-switch-qr-code-exploit-update-to-2300/" description: "Nintendo Switch QR code exploit warning: update your system to firmware 23.0.0 today to prevent unauthorized code execution via scanned QR codes." author: "Patrick Dankers" published at: "2026-09-12 19:10:03" image: "https://www.nintendoreporters.com/storage/files/nintendo-warns-of-switch-qr-code-exploit-update-to-2300.jpeg" markdown url: "https://www.nintendoreporters.com/en/news/nintendo-switch-2/nintendo-warns-of-switch-qr-code-exploit-update-to-2300.md" --- Nintendo warns of Switch QR code exploit - update to 23.0.0 | Nintendo Switch 2 News | NintendoReporters [![Nintendo warns of Switch QR code exploit – update to 23.0.0](https://www.nintendoreporters.com/storage/files/nintendo-warns-of-switch-qr-code-exploit-update-to-2300.jpeg "Nintendo warns of Switch QR code exploit – update to 23.0.0")](https://www.nintendoreporters.com/storage/files/nintendo-warns-of-switch-qr-code-exploit-update-to-2300.jpeg)**Summary:** Recently Nintendo published a security notice about a proximity-based vulnerability that affects Nintendo Switch systems running firmware older than 23.0.0. The issue can occur when a third party directly scans certain QR codes that appear on the console or TV screen during the Send to Smartphone process in the Album or while pairing a kart in Mario Kart Live: Home Circuit. If a malicious QR scan happens, it could allow unauthorized code to run or let someone obtain information stored on the console. The risk is limited to those scenarios and does not apply to Nintendo Switch 2 systems. Nintendo recommends updating to firmware 23.0.0 and following simple precautions if you cannot update right away. Below we explain what happened, who is affected, how to update, and what you should do to stay safe. --- ## [](#what-nintendo-announced-about-the-qr-code-vulnerability)What Nintendo announced about the QR code vulnerability Nintendo posted a formal advisory titled “Potential Nintendo Switch Console Information Leak Due to Proximity-Based Remote Attack” on September 10, 2026. The notice explains that, in a narrow set of situations, a QR code displayed by the console can be scanned directly by a third party and used to trigger unauthorized code execution or read certain data. The company assigned a CVE identifier to the issue and published steps to mitigate risk. The simplest fix Nintendo provides is to update affected Switch systems to system version 23.0.0. If you want to read the original advisory you can see Nintendo’s PDF for details, but for most players the immediate takeaway is straightforward – update the console and avoid letting strangers scan any QR codes that appear on your screen. ### [](#which-systems-are-affected-and-who-is-safe)Which systems are affected and who is safe The vulnerability only affects Nintendo Switch systems running a system version earlier than 23.0.0. Nintendo explicitly notes that Nintendo Switch 2 is not affected by this advisory, so owners of the newer hardware do not need to worry about this specific QR-based attack. If you own a standard Switch, Switch Lite, or other unit that has not yet been updated, you are potentially exposed when you generate a QR code on the console screen for features like Send to Smartphone in the Album or when pairing a Mario Kart Live kart. For maximum safety, update any Switch that can reach Nintendo’s update servers and avoid scanning or letting others scan QR codes from your screen until you have the update installed. If you want a quick refresher about Switch and Switch 2 differences, check our Nintendo Switch and Nintendo Switch 2 pages for background and guides. ### [](#how-the-exploit-works-in-practical-terms)How the exploit works in practical terms The exploit relies on proximity and interaction. When you use the Send to Smartphone feature or pair a Mario Kart Live kart, the console generates a QR code on its display or the TV. Normally you scan that QR code with your phone or the kart camera to establish a local connection and transfer screenshots or pair devices. The reported vulnerability means that if a malicious actor physically scans that QR code with their device at the same time, they could manipulate the connection process and trigger unauthorized code or retrieve some stored information. It is not a remote internet attack in the usual sense – someone needs to be close enough to scan the on-screen code. That limitation reduces the realistic exposure for many users, but it is still a clear vector that Nintendo patched with 23.0.0. #### [](#preventative-measures-nintendo-recommends)Preventative measures Nintendo recommends Nintendo’s advice is practical and simple: update to system version 23.0.0 as soon as possible. If you cannot update right away, pay attention to the environment whenever the console shows a QR code. Avoid public or crowded places when using Send to Smartphone or pairing karts from Mario Kart Live: Home Circuit, and do not let people you do not trust scan the code. Nintendo also recommends using only your own smart devices when transferring screenshots and avoiding karts that are not yours during play. These steps reduce the chance that a third party can intercept the pairing process or execute the exploit. Ultimately the update removes the vulnerability, so updating remains the top recommendation. #### [](#quick-step-by-step-update-your-nintendo-switch)Quick step-by-step: update your Nintendo Switch Updating is straightforward. From the HOME Menu go to System Settings, then System, and check the current System Version. If your console is able to connect to the internet, it should download and install the latest update automatically, or you can force the update manually from the same menu. If you have trouble updating immediately because you are offline, avoid using Send to Smartphone and avoid pairing karts until you can update. If you want more help with update steps or other Switch how-tos, our [Nintendo Guides](https://www.nintendoreporters.com/en/nintendo-guides/) section has clear walkthroughs and tips for everyday tasks. ## [](#specifics-for-mario-kart-live-home-circuit-pairing)Specifics for Mario Kart Live: Home Circuit pairing Mario Kart Live uses on-screen QR codes to pair the physical kart’s camera to the console. That very same pairing flow is identified in Nintendo’s advisory as a situation that could be abused if a third party directly scans the code. If you own Mario Kart Live, make sure you update the console before pairing karts in a public or shared space. Use only your own kart and avoid letting others bring or scan different karts in your home while pairing. The risk is limited but real – treat the pairing screen like a password prompt and keep it private while it is visible. Those simple habits cut down the chance of a proximity-based attack significantly. ### [](#what-this-means-for-privacy-homebrew-and-modding)What this means for privacy, homebrew, and modding It is natural to wonder whether this vulnerability opens the door to wide-ranging homebrew or data theft. The advisory makes clear the exploit is tied to a specific QR-based flow and requires proximity. That makes large-scale remote abuse unlikely, but it does not mean the issue is harmless – unauthorized code execution on a console is serious. For players who run unofficial software or do homebrew, this announcement is a reminder to be cautious when exposing pairing or sharing screens. For everyday players, the risk is lower and the recommended action is the firmware update. If you like tinkering, keep your experimental work offline until official fixes are applied and never use public transfers for sensitive files or accounts. #### [](#how-to-stay-safe-while-waiting-to-update)How to stay safe while waiting to update If you cannot update immediately, follow these practical habits: only use Send to Smartphone at home or in a controlled space, keep the console and TV screen away from windows or public sightlines, use only your own phone when scanning, and avoid pairing or using karts that belong to others. Treat QR codes generated by the console the same way you would treat a private link – do not show it to strangers or in open spaces. These are not tech-heavy suggestions – they are just sensible habits that reduce exposure. As soon as you can, install system version 23.0.0 and resume normal activity. ##### [](#conclusion)Conclusion Nintendo’s advisory is a reminder that even familiar features can reveal unexpected risks. The good news is the vulnerability is limited to specific on-screen QR flows and Nintendo released system version 23.0.0 on September 10, 2026, to address it. Update your Switch when you can and avoid letting others scan QR codes from your console or TV until the update is installed. If you have a Nintendo Switch 2, this advisory does not apply to your system. Keep an eye on official notices and follow simple pairing hygiene to keep your games and saves safe. NintendoReporters will keep watching the story and bring any meaningful updates to our community. ##### [](#faqs)FAQs - **Does this exploit affect Nintendo Switch 2?** - No. Nintendo states the vulnerability cannot be exploited to obtain console information on Nintendo Switch 2. - **Which Switch systems are vulnerable?** - Any Nintendo Switch system running a system version earlier than 23.0.0 is listed as affected. Update to 23.0.0 to remove the risk. - **How do I update to system version 23.0.0?** - From the HOME Menu select System Settings then System and check for updates. If connected to the internet your Switch should download and install the update automatically. - **Can someone exploit my Switch remotely over the internet?** - The advisory describes a proximity-based attack that requires directly scanning the QR code displayed on your console or TV, so it is not a classic wide-area remote internet exploit. - **What precautions should I take if I cannot update right away?** - Avoid using Send to Smartphone in public, do not allow others to scan QR codes from your screen, and use only your own smart device when transferring images or pairing karts. ##### [](#sources)Sources - [Potential Nintendo Switch Console Information Leak Due to Proximity-Based Remote Attack](https://www.nintendo.com/security-advisories/assets/pdf/20260910e.pdf), Nintendo, September 10, 2026 - [Nintendo Switch System Update Information – Version 23.0.0](https://www.nintendo.com/en-za/Support/Troubleshooting/Nintendo-Switch-System-Update-Information-1445507.html), Nintendo Support, September 10, 2026 - [Nintendo identifies Switch exploit in which bad actor could run code or obtain information stored on the console](https://nintendoeverything.com/nintendo-identifies-switch-exploit-in-which-bad-actor-could-run-code-or-obtain-information-stored-on-the-console/), NintendoEverything, September 10, 2026 - [Nintendo warns QR code vulnerability, launches firmware update](https://www.notebookcheck.org/Nintendo-advierte-de-que-una-vulnerabilidad-en-el-codigo-QR-de-la-Switch-podria-permitir-el-acceso-no-autorizado-a-la-consola-y-lanza-una-actualizacion-de-firmware.1396295.0.html), NotebookCheck, September 11, 2026 [](#) [ ](#) > Generated for use by AI and Large Language Models (LLMs). > Generated: 2026-09-12 20:27:59 > Maintained by: NintendoReporters > Source: https://www.nintendoreporters.com/ > Contact: webmaster@nintendoreporters.com