A newly exposed vulnerability in Broadcom’s Wi-Fi software, dating back to around 2010, makes certain routers vulnerable to remote takeover—even without knowing the Wi-Fi password. Security researcher Quentin Kaiser revealed the flaw during the Hexacon conference in Paris (October 16, 2026). The issue resides in Broadcom’s implementation of Wi-Fi Protected Setup (WPS), which has been built into its development kit for at least 16 years.
How the Flaw Operates
The vulnerability stems from weak length checks in the code that pieces together fragmented Extensible Authentication Protocol (EAP) messages used in the WPS handshake. Malicious actors can send specially crafted wireless frames that overflow a memory buffer, allowing them to read or alter memory contents and hijack the router’s control flow to run arbitrary code—even before the usual WPS enrollment finishes.
Because this is an over-the-air exploit, it doesn’t require knowing the network password or engaging in traditional password-cracking. An attacker simply needs to be within wireless range of the vulnerable router.
Proofs, Impact, and Affected Devices
Kaiser demonstrated the risks using real routers. In one test, he extracted the saved Wi-Fi password from an Orange Belgium ASKEY TCG3000 router via wireless frames, then joined the network using the stolen credentials. In another case, he gained a remote command shell on a Proximus BBOX3V+ router, also over wireless, without leveraging any external cloud service.
Devices confirmed vulnerable include: Proximus BBOX3V+, VOO’s Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233, and Orange ASKEY TCG3000. These are used by three Belgian ISPs. The estimated number of affected gateways in Belgium reaches about 1.56 million, though broader exposure globally is still unknown.
Attempts to patch started in 2018 when Broadcom offered replacement software based on hostapd and WPA Supplicant, moving away from their old WPS implementation. But many device manufacturers have not updated those components. As of October 15, 2026, the tested Belgian units remained unpatched. Meanwhile, Broadcom reportedly declined to assign a Common Vulnerabilities and Exposures (CVE) identifier to the issue.
Kaiser has also developed tools to help identify vulnerable firmware, including a wireless fingerprinting script and YARA rules. These are intended to flag risk but are not definitive proof of exploitability, and further expert review is recommended.
Broader Implications
This discovery highlights that a device’s stored password or strong Wi-Fi encryption alone may not be enough to ensure safety. Attacks like these show how deeply buried protocol weaknesses can undermine defenses long overlooked. It also connects to related threats such as “nearest-neighbor attacks,” where the proximity of compromised wireless devices increases exposure.
This is not the first time Broadcom has faced scrutiny for wireless security flaws—previous vulnerabilities have similarly revolved around WPS or Wi-Fi message handling. What’s new is the age of the vulnerability and how widespread the legacy code remains.
Analytically, this case underscores the challenge of fixing deeply embedded vulnerabilities: patches alone won’t help unless device makers adopt them and replace outdated components. For users and ISPs, the risk is clear—legacy features like WPS that haven’t been maintained can pose a severe threat. What to watch now: whether ISPs globally assess and apply replacements, whether Broadcom finally accepts a CVE, and how new router designs will phase out legacy WPS flows in favor of more secure frameworks.
