A 16-Year-Old Broadcom Wi-Fi Flaw Still Lets Nearby Attackers Run Code as Root on Millions of Routers — No CVE, No Patch, and Broadcom Won't Assign One
A 16-Year-Old Broadcom Wi-Fi Flaw Still Lets Nearby Attackers Run Code as Root on Millions of Routers — No CVE, No Patch, and Broadcom Won't Assign One
Security researcher Quentin Kaiser disclosed on October 16 a flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation that lets an attacker within radio range run code as root on Broadcom-based routers — no network password, no pairing step, no login. The bug mishandles the reassembly of fragmented WPS setup messages, so crafted over-the-air messages corrupt the router's memory. Kaiser demonstrated two working outcomes on Belgian ISP gateways: against an Orange Belgium Askey TCG3000, he read the Wi-Fi password (the PSK) out of the device's stored settings, sent it back over the air, and joined the network; against a Proximus Sagemcom BBOX3V+, he opened a reverse shell carried entirely over Wi-Fi frames, with no outside server needed.
The scale is unusual for a Wi-Fi bug. Broadcom's WPS code ships in routers and access points from dozens of vendors, and Kaiser estimates millions of devices worldwide are affected. His Belgian counts alone run north of 1.5 million exposed gateways — roughly 850,000 Proximus, 500,000 VOO legacy, and 210,000 Orange Belgium — with Telenet unconfirmed. His wider list spans Cisco small-business access points, Huawei, and ARRIS gear, mixing confirmed and "likely vulnerable" entries. The exposure splits by chip family: older eCos-based models (BCM3380, BCM3383, BCM33834) never received a usable fix — Kaiser calls them permanent "forever days" — while newer Linux-based models (BCM3390, BCM65xx, BCM68xx) could be fixed if their makers switch Wi-Fi software to hostapd.
The reason there is no CVE and no coordinated patch is the story's core. The code dates back to at least 2010; Broadcom shipped an incomplete fix in 2018 and told customers to move to hostapd rather than rely on it. When Kaiser reported the bugs in July 2026, Broadcom said a patch was available and referred him to the device manufacturers, but refused to assign a CVE or make any public statement. CERT/CC opened a case and closed it the same day, because Broadcom itself holds the CVE authority for its products. Kaiser — who says AI-assisted analysis found the bugs in under a week instead of months — is publishing YARA rules for extracted firmware and a script that fingerprints live access points, because nobody, including him, has a complete picture of affected deployments.
No real-world attacks using the flaw have been observed, and the realistic risk is targeted rather than opportunistic: attackers within Wi-Fi range of a victim, in hotels, adjacent offices, or across the street — a technique Russian state hackers have used to breach networks from a parked car. A compromised router is quiet infrastructure for intercepting traffic, and the firmware on ISP-supplied gateways is the last thing most users and security teams ever check.
What Should You Do?
- Inventory your fleet — run Kaiser's YARA rules against extracted firmware or the live-AP listener against your access points. A hit is triage, not confirmation, but it tells you which devices to escalate or replace.
- Push your vendors — ask your ISP or AP vendor whether your model runs the affected Broadcom WPS code and whether a hostapd-based software line exists. On the newer Linux-based chips this is fixable; the question is whether the vendor will do it.
- Plan replacement for eCos-era devices — they will never be patched. Segment what you cannot replace: guest VLANs, no enterprise credentials on that Wi-Fi, no sensitive sessions through it.
- Treat Wi-Fi range as attack surface — in hotels, shared buildings, and dense offices, don't run sensitive operations over ISP-router Wi-Fi that nobody can audit or update.
The WAF Angle
Nothing in this attack ever touches HTTP, so no WAF will see it — the same blind spot as the Cling botnet living in old router firmware and the hijacked supermarket-fridge controllers: embedded firmware your web defenses cannot instrument. The lesson is perimeter humility — your real attack surface extends past the edge you monitor, into CPE firmware nobody plans to fix, and lifecycle replacement rather than patching is the actual control there. For web teams the practical translation is simple: never route business traffic through infrastructure you cannot audit, and assume the router in reception is hostile if you cannot say who last updated it.
