If your Nintendo Switch (1) is still running an older firmware version, it's time to update. Nintendo recommends all users install system update 23.0.0 as soon as possible, which was released on September 10th at the same time as the Nintendo Switch 2 update. In addition to the usual system stability improvements, the new system version also fixes a serious vulnerability, the details of which have recently emerged.
The flaw, recorded as CVE-2026-82079, is classified as a stack buffer overflow vulnerability and resides in the "send to smartphone" function, which generates a QR code to transfer screenshots, recordings and data to the phone. According to what Nintendo itself reported, an attacker within range of the wireless network could scan the QR code before the legitimate owner, connect to the console and execute unauthorized code and/or steal the information stored on it. In fact, the account is saved on the console, which includes a set of particularly protected personal data (the generic data, so to speak) which, if combined, can profile the user (for definitions see the“Art. 5 of the Data Protection Act, DPA, RS 235.1).
The same defect would also affect Mario Kart Live: Home Circuit, the set that uses the same QR code system to communicate with smartphones, and can therefore be used in the same way. The most recent console, however, apparently needs to be excluded: The vulnerability would not affect Nintendo Switch 2. In essence, an update that would be easy to dismiss as routine is proving to be increasingly relevant for the security of your data. Considering that the patch has been available for almost a week and that the console automatically offers it the next time you connect, most users should now be covered. For those who haven't already done so, a quick visit to the system settings is recommended. Of course, in the event of any suspected data theft resulting from this flaw (or if you notice that the aforementioned data has been used without your authorization), the author recommends contacting the competent authorities for civil matters (disputes concerning the protection of personality under our Civil Code) and/or criminal prosecution if the data has been used to steal money or, for example, if you have been the victim of (attempted) phishing.