Switch QR security flaw has one simple fix: update to 23.0.0

If your original Nintendo Switch is running firmware earlier than 23.0.0, update it. Nintendo’s September 10 security notice covers a flaw that can expose console information or permit unauthorized code execution when someone nearby directly scans a QR code shown during specific Switch features.

The practical risk is limited, which is the important part: this is not an internet-wide attack waiting behind every public Wi-Fi connection. A bad actor needs to be physically close enough to scan the QR code displayed on your Switch or TV in real time. But “limited” is not a reason to leave an old system version installed when Nintendo has already shipped the fix.

Older Switch firmware is the target, not Switch 2

Nintendo says the affected hardware is Nintendo Switch running a system version earlier than 23.0.0. The company also states that the vulnerability cannot be used to obtain console information from Nintendo Switch 2.

The vulnerable situations are unusually specific: Album > Send to Smartphone, which puts QR codes on-screen to establish a wireless transfer connection, and the setup flow for Mario Kart Live: Home Circuit. In both cases, the exploit depends on a third party directly scanning the displayed code.

That proximity requirement matters. Someone cannot pull this off from across the internet. They need sight of the QR code. Still, anyone using screenshot transfer on a shared TV, in a public space, or around people they do not trust has a very obvious reason to patch now rather than treating security updates as optional housekeeping.

The workaround is basic because the problem is avoidable

Update the console to version 23.0.0 through System Settings > System > System Update. Switch consoles connected to the internet generally download system updates automatically, but checking manually is the clean way to confirm the installed version.

• Do not let anyone else scan the QR code shown during Send to Smartphone.
• Use only your own phone for the Album transfer process.
• For Mario Kart Live: Home Circuit, use only your own kart.
• If an update cannot be installed immediately, avoid displaying those QR codes where a third party can scan them.

Nintendo has not publicly detailed the technical root cause, the full scope of possible leaked data, or a severity rating. That restraint is normal for a freshly patched security issue. It also means players should avoid filling in the blanks with panic: the company has described the access condition clearly, and the patch is already live.

Version 23.0.0 carries more than a security patch

The security notice arrived alongside a substantial update for both Switch generations. On Switch 2, the headline addition is variable refresh rate support in TV Mode. It can match output refresh rate to a game’s processing speed when the game and television support VRR, though owners also need a compatible Nintendo Switch 2 Dock firmware update. That last requirement is exactly the sort of footnote that turns a “new feature” into a support-thread scavenger hunt.

Switch 2 also gets Handheld Boost Mode in quick settings, expanded GameChat controls, separate TV sound settings for each connected display, and a complete console-to-console transfer option under System > Transfer all to Nintendo Switch 2. That transfer covers save data and screenshots, a welcome improvement for anyone moving between two Switch 2 systems.

Across the update, Nintendo added a Mii QR-code sharing tool, Mii editor background music controls, aggregated play activity across consoles, Portuguese (Brazil) options for text-to-speech and GameChat voice-to-text, and a Virtual Game Card settings entry for checking registered-device status. If a virtual game card cannot be transferred when starting software, the system can now show a Play with Online License button; only the account that bought the game can use that route.

What to watch: the firmware number, not the panic cycle

Check that an original Switch displays version 23.0.0 or later before using Album’s Send to Smartphone feature again. Switch 2 owners should update as well for the broader feature set, but Nintendo’s advisory specifically excludes Switch 2 from console-information extraction through this flaw. The meaningful unanswered question is whether Nintendo later publishes a fuller technical postmortem; for players, the useful action is already available in System Settings.