Unpatched Broadcom WPS Bug Gives Nearby Attackers Root on Millions of Routers

A memory-corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) code lets anyone within radio range take full control of an affected router — no Wi-Fi password, no pairing button, no login. There is no CVE, no vendor advisory and, for an entire family of older chips, no fix that will ever ship.

What happened

Security researcher Quentin Kaiser published the findings on October 16. The bug sits in how Broadcom's WPS implementation stitches together fragmented setup messages. By sending deliberately malformed fragments over the air, an attacker can corrupt the router's memory, leak data from it and ultimately execute their own code as root.

Kaiser demonstrated working attacks against ISP-supplied home gateways in Belgium:

Orange Belgium (Askey TCG3000): the exploit pulled the stored Wi-Fi passphrase out of the device's configuration, sent it back over the air and used it to join the network.
Proximus (Sagemcom BBOX3V+): the exploit opened a remote shell tunnelled entirely through Wi-Fi frames — no internet-facing server required.

Gateways from VOO were also found exploitable; Telenet equipment may be affected but could not be tested. Both demonstrations required no authentication and, according to the researcher, work at a distance rather than only at close range. No in-the-wild exploitation has been reported — the working exploits are the researcher's own.

Why it matters

Broadcom's WPS code ships inside routers and access points from dozens of vendors, and Kaiser estimates millions of devices worldwide are exposed. The affected silicon splits into two groups:

Older eCos-based chips (BCM3380, BCM3383, BCM33834): no usable fix exists. Kaiser calls this a "forever day" — a bug that will never be patched on these devices.
Newer Linux-based chips (BCM3390, BCM65xx, BCM68xx): fixable, but only if device makers move to a different Wi-Fi stack (hostapd).

A broader device list — spanning Cisco small-business access points through Huawei and ARRIS routers — mixes confirmed and unconfirmed entries, some flagged only as "likely vulnerable" by automated checks, so treat it as a starting point rather than a verdict.

The disclosure history is the bigger lesson. The vulnerable code dates back to at least 2010. Kaiser says Broadcom shipped an incomplete fix in 2018 and told customers to switch to hostapd instead, but never registered a CVE or issued a public notice. Because Broadcom is its own CVE Numbering Authority, a request through CERT/CC was closed the same day. Without an identifier, most vendors and defenders had nothing to track — which helps explain why so many devices were never fixed.

The attack model also deserves attention: compromising a network from a nearby car park or neighbouring building, rather than over the internet, is a technique state-backed groups have used before. A home or branch-office gateway is a cheap, quiet foothold.

What to do

Inventory Broadcom-based gear. Identify routers, gateways and access points in offices, branches and remote-worker homes that run the chip families above. Ask your ISP and hardware vendors directly whether their devices are affected.
Use the researcher's triage tools. Kaiser released YARA rules that flag the vulnerable code in extracted firmware, plus a script that listens to a live access point and reports whether it looks vulnerable. A match is a reason to investigate further, not a confirmed finding — patched devices can still trigger the rules.
Plan replacement for eCos-based devices. There is no patch to wait for and no configuration setting known to block the attack. Turning WPS off is reasonable hygiene, but it has not been confirmed as a mitigation here.
Contain what you can't replace yet. Treat Wi-Fi on affected devices as untrusted: segment it away from sensitive systems, and keep critical access behind VPN and strong authentication rather than relying on the local network.
Watch for vendor updates on Linux-based models that move to hostapd.

Proximity attacks like this rarely show up in an internet-facing scan, which is why our penetration testing team includes on-site wireless assessments — mapping the access points and gateways around your premises and checking them against known flaws such as this one before an attacker in the car park does.

Originally reported by The Hacker News; research by Quentin Kaiser.