Update: 5/03/2023 - New evidence on the reason Mario kart 8 and Splatoon has been taken offline due to a severe vulnerability attack! See below for more details.
Update: 6/03/2023 - Added an additional source [11] looking into how the vulnerability attack works.
Original Post
Due to a major security issue concerning online play, Nintendo has taken two of their strongest juggernauts offline on Wii U since March 3rd[1] with no clear date announced on when they will ever come back online.
Currently, this does not affect the Switch version of Mario Kart 8 Deluxe with online services still running as expected however, the original Splatoon never saw a release on the Nintendo Switch, barring off most of its online functionality indefinitely. While Splatoon does have a single player campaign, it's a small portion of the overall experience with a total playtime estimate of about 5 hours[2], its main selling point is the Multiplayer online mode.
As it is unclear when they will come back online, another question arises: "How long will Nintendo keep the Wii U's online servers up for?" After all, the Wii U (and 3DS) eShop closes down this March on the 27th[3] and the console itself ceased production since 2017[4]. With the rise and highly successful Nintendo Switch now having two Splatoon sequels[5], and Mario Kart 8 Deluxe receiving a high volume of DLC waves[6], it's clear their priorities are no longer set on supporting the Wii U titles.
While Nintendo has been noted for its efforts on game preservation, most notably adding Gameboy and Gameboy Advance titles to their Switch online service[7], it seems unlikely that the first Splatoon game will ever receive a full Switch port, however, there has been some preservation efforts. For example, Splatoon 3 is receiving DLC in the form of porting Inkopolis into the game[8] and a handful of stages have already been added into the sequels[9].
Update: 5/03/2023
According to a tweet made on the 25th of December, 2022, user PabloMK7 made a thread going over "a severe vulnerability in many first party 3DS, Wii U and Switch games.[10]"
Click on the image below to view the full thread.
PabloMK7 was later asked a question in regards to which games to avoid, to which Mario Kart 8 and Splatoon was specifically noted down as unpatched, leading to the reason why these two games were taken offline recently by Nintendo.
PabloMK7 goes on to explain in their investigation, they were slammed with a $1,000 bounty after finding an attacker in Mario Kart 7 as seen in the video at the start of the thread. "In the video, the remote console is forced to run a CFW installer (SafeB9SInstaller). Using the same tchniques, it would be theoretically possible to steal account/credit card information or take unauthorized audio/video recordings using the console built-in mic/cameras.[11]"
It is also important to note, there may still be games affected by this vulnerability. To find out more about which games have been affected, the vulnerability has now been assigned a CVE ID: CVE-2022-47949. According to the report, attackers can "execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn.[12]" It also lists several games as follows:
Animal Crossing: New Horizons (Patched in 2.0.6)
Mario Kart 7 (Patched in 1.2)
Mario Kart 8
Mario Kart 8 Deluxe (Patched in 2.1.0)
ARMS (Patched in 5.4.1)
Splatoon
Splatoon 2 (Patched in 5.5.1)
Splatoon 3 (Patched in late 2022)
Super Mario Maker 2 (Patched in 3.0.2)
Nintendo Switch Sports (Patched in late 2022)
Be extra vigilant and take care when playing any 3DS, Wii U or Switch titles with online functionality that are not yet known or reported to have received a patch.
This article will be updated accordingly once online functionality for Mario Kart 8 and Splatoon for Wii U has been restored.
Sources
[1] https://www.nintendo.co.jp/netinfo/en_GB/index.html [Nintendo's current server stats]
[2] https://howlongtobeat.com/game/21286 [It takes 5 hours to beat Splatoon's campaign]
[3] https://en-americas-support.nintendo.com/app/answers/detail/a_id/57847/~/wii-u-%26-nintendo-3ds-eshop-discontinuation-q%26a [The Nintendo eShop for Wii U and 3DS shuts down on March 27th]
[4] https://kotaku.com/wii-u-production-has-officially-ended-for-japan-1791813878 [The Wii U officially stopped production in 2017]
[5] https://splatoonwiki.org/wiki/Splatoon_(series)#Video_games [There are 3 Splatoon games currently out, with the first one released exclusively on Wii U only]
[6] https://mariokart8.nintendo.com/booster-course-pass/ [Mario Kart 8 Deluxe Booster Course Pack DLC]
[7] https://www.youtube.com/watch?v=_-KAU3bK1Y8 [Nintendo's Direct trailer for Gameboy and Gameboy Advance titles for Switch Online]
[8] https://www.youtube.com/watch?v=qpn0UPPvAb8 [Nintendo's Direct trailer for Splatoon 3 receiving DLC in the form of porting Inkopolis into the game]
[9] https://splatoonwiki.org/wiki/Stage [A list of all the Stages from each game. Some stages from the first Splatoon game have made an appearance in Splatoon 2 and 3]
[10] https://twitter.com/Pablomf6/status/1606637941329215488 [Twitter user, PabloMK7 made a thread going over "a severe vulnerability in many first party 3DS, Wii U and Switch games]
[11] https://github.com/PabloMK7/ENLBufferPwn [A thorough deep dive explanation for how the vulnerability attack works]
[12] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-47949#:~:text=The%20Nintendo%20NetworkBuffer%20class%2C%20as,game%20session%20with%20the%20attacker. [Official CVE site listing the threat and known affected titles]