Critical Broadcom Wi-Fi Flaw Lets Attackers Hack Routers

Key Takeaways

• A critical 16-year-old vulnerability in Broadcom’s Wi-Fi Protected Setup (WPS) implementation allows attackers to compromise routers wirelessly.
• The flaw, present since at least 2010 in Broadcom’s SDK, enables memory leaks and arbitrary code execution without needing the network password.
• Millions of devices globally, including those from major Belgian ISPs like Proximus, VOO, and Orange, are estimated to be affected.
• Broadcom reportedly offered replacement software in 2018, but many device manufacturers have not updated, leaving numerous routers unpatched.

A long-standing security vulnerability, present for 16 years within Broadcom’s Wi-Fi software, could allow nearby attackers to gain full control over affected routers without requiring the network’s password.

The issue was publicly disclosed by security researcher Quentin Kaiser at the Hexacon conference in Paris on October 16, 2026. Kaiser highlighted that the outdated code remains embedded in a vast number of currently deployed devices, posing a significant security risk.

Kaiser’s investigation revealed that the flaw has been part of Broadcom’s software development kit since at least 2010. It specifically impacts the company’s proprietary implementation of Wi-Fi Protected Setup (WPS). Exploiting this vulnerability can lead to memory leaks and the execution of attacker-controlled code, even before the standard WPS enrollment process is complete.

The vulnerability resides in the code responsible for processing fragmented Extensible Authentication Protocol (EAP) messages used by WPS. Insufficient length validation checks permit specially crafted wireless messages to trigger a memory buffer overflow.

Deep Dive: The Broadcom Wi-Fi Flaw

Exploiting this flaw allows attackers to read from or modify memory and subsequently alter the router’s program flow to execute their own malicious code. This is an “over-the-air” attack, meaning the attacker only needs to be within wireless range of the target router; knowledge of the network password is not required, nor is it a password-cracking technique.

Kaiser successfully demonstrated the exploit by extracting the stored Wi-Fi password from an Orange Belgium ASKEY TCG3000 router and transmitting it back through wireless frames. Following this, he was able to connect to the network using the stolen credentials.

A second proof-of-concept against a Proximus BBOX3V+ router showcased the ability to establish a remote command shell via Wi-Fi frames, eliminating the need for an external cloud command server. These demonstrations underscore that even robust network passwords cannot prevent exploitation of devices running the vulnerable software.

Kaiser confirmed exploitation on devices utilized by three prominent Belgian internet service providers. These include the Proximus BBOX3V+, VOO’s Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233, and Orange’s ASKEY TCG3000. Potential exposure involving Telenet equipment is currently unconfirmed.

The researcher estimates that approximately 1.56 million gateways across Proximus, legacy VOO, and Orange in Belgium could be affected. These figures are based on Kaiser’s research and have not been independently verified by the providers. He warns that the broader issue could impact millions of access points globally, though a precise worldwide count remains elusive.

This discovery follows previous concerns regarding Broadcom-related wireless security, including the distinct Kr00k Wi-Fi vulnerability. The current research, however, focuses specifically on the handling of WPS messages, not the earlier flaw.

Kaiser noted that a patch issued in 2018 was incomplete. According to correspondence reproduced in his presentation slides, Broadcom acknowledged awareness of the issue for a significant period and stated it had provided replacement software, based on hostapd and WPA Supplicant, since 2018. This effectively places the responsibility on device manufacturers to transition away from the legacy implementation.

Kaiser reported the eCos-related issue on July 18 and the Linux-related issue on July 27. He stated that Broadcom declined to assign a Common Vulnerabilities and Exposures (CVE) identifier, and as of October 15, the tested Belgian devices remained unpatched.

His detection toolkit includes a wireless fingerprinting script and YARA rules designed for firmware analysis. These tools are intended for initial screening and do not definitively confirm exploitability, requiring further validation.

This risk also brings renewed attention to Nearest-Neighbor attacks, where nearby compromised systems facilitate wireless access. While that particular attack utilized different methodologies, it highlights the critical importance of mitigating vulnerabilities that allow local Wi-Fi exposure.

What You Should Do

• Check for Firmware Updates: Immediately consult your router manufacturer’s website for any available firmware updates. Prioritize installing patches that address WPS vulnerabilities.
• Disable WPS: If possible, disable Wi-Fi Protected Setup (WPS) on your router. While convenient for setup, WPS has a history of security vulnerabilities.
• Monitor Network Activity: Regularly review your router’s logs for unusual activity or unauthorized connections.
• Consider Router Replacement: If your router is an older model from an affected vendor and no patches are available, consider upgrading to a newer device with active security support.
• Strong Passwords Still Matter: While this exploit bypasses the need for a password, maintaining strong, unique Wi-Fi passwords remains a fundamental security practice for other attack vectors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.