Even in the NES days, there were various errors in games or console firmware that hackers exploited to run cheats or play pirated copies. Traditionally, however, the owner had to actively choose to exploit these vulnerabilities. The error presented today is much more serious.
Hacker PabloMK7 revealed today “ENLBufferPwn‘, perhaps the most serious vulnerability ever found in a Nintendo system. With it, it is possible to gain complete control over another system when in the same online lobby with the victim. Not only can hackers use it to manipulate games, but in the case of the Nintendo 3DS and Wii U, they can also record video and sound. Nintendo was made aware of the bugs by multiple hackers in 2021 and 2022 via the HackerOne program, resulting in quite a few games receiving updates. The best-known example is the recently released update for Mario Kart 7. However, not all games have been updated yet. With Mario Kart 8 and Splatoon, only two major Wii U games are vulnerable. We have attached a list of some of the affected games. Titles that have not been previously reported may also be vulnerable to the bug.
- Mario Kart 7 (bugs fixed with version 1.2)
- Mario Kart 8 (bug not fixed yet)
- Mario Kart 8 Deluxe (bugs fixed with version 2.1.0)
- Animal Crossing: New Horizons (bugs fixed with version 2.0.6)
- ARMS (bug fixed with version 5.4.1)
- Splatoon (bug not fixed yet)
- Splatoon 2 (bug fixed with version 5.5.1)
- Splatoon 3 (bug fixed in late 2022)
- Super Mario Maker 2 (bugs fixed with version 3.0.2)
- Nintendo Switch Sports (bug fixed in late 2022)
At least in Mario Kart 7, the bug has already been exploited, as a previously unknown video by a Japanese player on YouTube shows.
Whether newer games like Pokémon Crimson or Crimson contain this vulnerability is unknown. However, since this was pointed out to Nintendo several months ago, Nintendo Switch Sports may well have been the most recent game to struggle with the issue. Now the question is, will Nintendo update Splatoon and Mario Kart 8, or maybe disable online features for those titles altogether? We’ll keep you up to date.
