A security researcher has disclosed a flaw in Broadcom’s Wi‑Fi setup software that could let an attacker in radio range execute code as root on Broadcom-based routers without needing a network password or any pairing step. The bug affects Broadcom’s implementation of Wi‑Fi Protected Setup (WPS), where fragmented WPS messages are not reassembled correctly, allowing crafted frames to corrupt a device’s memory.
The researcher, Quentin Kaiser, demonstrated the issue against home gateways used by three Belgian ISPs, with one test reading the Wi‑Fi PSK from stored settings and transmitting it over the air, and another test opening a remote shell over Wi‑Fi frames. The attacks reportedly work at distance and require no login, though Kaiser notes there have been no recorded real‑world exploits yet and the exploits he used are his own.
Broadcom‑coded WPS is embedded in routers and access points from many vendors, with Kaiser estimating millions of devices could be affected. Wheel‑chairing the affected hardware are older eCos‑based models (BCM3380, BCM3383 and BCM33834) for which no usable fix exists, and newer Linux‑based models (BCM3390, BCM65xx and BCM68xx) that could be patched if manufacturers switch the Wi‑Fi software.
Patch availability varies by vendor and region; in Belgium the flaw was found exploitable on gateways from Proximus, Orange Belgium and VOO, with a rough estimate of hundreds of thousands of affected gateways, and possibly more across other providers. There is no CVE yet, and Broadcom has not issued a fix or a public CVE record, leaving defenders with firmware analysis and firmware‑extraction triage tools rather than a straightforward patch. Kaiser suggests replacement as a practical option for devices that cannot be fixed.