Security researcher Quentin Kaiser has disclosed a severe vulnerability in Broadcom’s Wi-Fi Protected Setup (WPS) code that allows attackers within wireless range to gain root privileges on routers—without ever needing the Wi-Fi password or prior pairing. The flaw hinges on how Broadcom’s software reassembles fragmented WPS setup messages, which can be malformed to corrupt internal memory, enabling remote code execution. On October 16, Kaiser demonstrated this against live devices from Belgian ISPs.
In one test, an Orange Belgium gateway (an Askey TCG3000 model) had its stored PSK retrieved over the air, which then allowed full network access. In another instance, a Proximus gateway (the Sagemcom-built BBOX3V+) was forced to execute a reverse shell delivered via crafted Wi-Fi frames—no physical access or login required. These exploits work from wireless distance; not just up close.
What Gear’s Affected & What’s Broken
The vulnerability is widespread. Broadcom’s WPS code is embedded in routers and access points from many manufacturers. Kaiser estimates that millions of devices globally are exploitable. The two chip families affected differ in the possibility of patching: older eCos-based chips (BCM3380, BCM3383, BCM33834) have no viable fix, making them permanent, unpatchable liabilities—what Kaiser calls “forever-day” flaws. More modern Linux-based chips (e.g. BCM3390, BCM65xx, BCM68xx) may be fixable if their vendors replace vulnerable Wi-Fi software.
In Belgium alone, ISP gateways from Orange Belgium, Proximus, and VOO were confirmed vulnerable; Telenet may also be affected but couldn’t be tested. A broader list—covering Cisco small-business access points, Huawei hardware, ARRIS routers, and others—shows a mix of confirmed and likely vulnerabilities. The number of impacted devices runs into the hundreds of thousands just in Belgium.
Why No CVE or Patch Yet
The flaw dates back over a decade, with Broadcom delivering an incomplete mitigation in 2018 and urging customers to migrate to alternative software (like hostapd) rather than relying on its fixing of the old code. For devices using older eCos chips, no fix was ever provided, which leaves those permanently exposed. More modern models stand a chance, if their manufacturers act.
No Common Vulnerabilities and Exposures (CVE) identifier has been assigned yet. Broadcom reportedly acknowledged knowing of this vulnerability since 2018 but has reportedly declined to publish a CVE or publicly disclose the bug in detail. When Kaiser contacted the CERT Coordination Center, the case was closed the same day because Broadcom holds the power to assign CVEs for its own product lines—and has chosen not to.
What You Can Do If Your Device Is Affected
There is no patch currently available for many affected devices, and no configuration setting that reliably blocks the exploit. Kaiser has provided tools to help owners determine if their equipment is vulnerable: YARA rules to inspect firmware for the flawed code and a script that listens to live Wi-Fi traffic to detect tell-tale signs. However, matching these checks doesn’t guarantee a device is safe, since a patched unit might still flag a match. For permanently vulnerable gear—especially older models—replacement is likely the only reliable mitigation.
While there’s no known instance of this flaw being used in real attacks yet, its potential is significant. Grabbing administrative control over routers via wireless range has been part of the playbook in nation-state surveillance and remote network breaches.
This vulnerability highlights the long-simmering risks in embedded software and legacy IoT hardware. Broadcom’s refusal to assign a CVE or provide full transparency leaves many users vulnerable without knowing it. For device makers using Broadcom chips—and for end users dependent on those devices—the pressure is now: demand firmware transparency, prioritize replacements for unpatchable hardware, and monitor developments closely.
