A newly disclosed vulnerability in Broadcom’s Wi-Fi setup software could allow an attacker within wireless range to execute code with root-level privileges on certain Broadcom-based routers without requiring a network password or device pairing. Security researcher Quentin Kaiser disclosed details of the flaw on October 16, highlighting potential risks for affected routers and access points using vulnerable versions of Broadcom’s Wi-Fi Protected Setup (WPS) implementation. Kaiser demonstrated the attack against home gateways provided by three Belgian internet service providers, showing that the vulnerability could be exploited in different ways depending on the affected device. In one case, he was able to retrieve the stored Wi-Fi password from the device, while another demonstration showed the ability to open a remote shell over a wireless connection. No CVE identifier has been assigned to the issue, and Kaiser stated that affected routers tested during his research had not received a security update addressing the vulnerability.
The issue exists in Broadcom’s implementation of Wi-Fi Protected Setup, a feature designed to allow devices to connect to wireless networks without manually entering a password. According to Kaiser’s research, the software incorrectly handles fragmented WPS setup messages, allowing specially crafted messages to affect the router’s memory. By exploiting this weakness, he developed methods to read information from the device memory and execute custom code on affected systems. During testing, an Orange Belgium gateway using the Askey TCG3000 device allowed Kaiser to retrieve the Wi-Fi password stored within the router configuration and transmit it over the wireless connection before joining the network. A Proximus gateway using the Sagemcom-built BBOX3V+ device was also tested, where the researcher demonstrated a reverse shell capability that provided remote command access through Wi-Fi frames without requiring an external server connection.
Kaiser stated that the attacks could be carried out from a distance and did not require physical access to the devices. He also noted that there have been no confirmed real-world attacks using this vulnerability and that the exploit methods were developed as part of his research. The researcher estimates that millions of devices globally could potentially be affected because Broadcom’s WPS software is used across routers and access points from multiple manufacturers. The affected hardware includes older eCos-based Broadcom chip families such as BCM3380, BCM3383 and BCM33834, where Kaiser reported that no effective fix has been identified. He described these devices as potentially facing a permanent security issue if manufacturers cannot replace the vulnerable software components. Newer Linux-based Broadcom chip families, including BCM3390, BCM65xx and BCM68xx, may receive fixes if device manufacturers transition to alternative Wi-Fi software implementations.
Kaiser reported finding exploitable devices among gateways used by Proximus, Orange Belgium and VOO in Belgium, while another provider, Telenet, could not be fully tested. His wider list includes devices from several manufacturers, including Cisco small-business access points, Huawei and ARRIS routers, although some entries are based on automated checks indicating that devices are likely vulnerable rather than confirmed cases. The researcher also explained that the vulnerability has existed in Broadcom code for many years, with traces dating back to at least 2010. According to Kaiser, Broadcom provided an incomplete update in 2018 and recommended moving to another Wi-Fi software package called hostapd instead of relying on the earlier mitigation. He further stated that older eCos-based devices did not receive a practical fix.
As there is currently no universal patch available, Kaiser has shared detection resources including YARA rules and a script designed to identify potentially affected firmware and access points. These tools are intended for security assessment purposes and may require additional verification because a detection result does not always confirm active exposure. For devices that cannot receive updates, replacement may be the recommended approach. The disclosure highlights the continued importance of securing wireless infrastructure, particularly as attackers increasingly look for opportunities to access networks through nearby devices. Organizations and users managing affected routers are advised to monitor vendor updates, review available security guidance and consider replacing unsupported hardware where necessary.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
