A critical vulnerability has been identified in Broadcom’s Wi-Fi setup software, enabling attackers to execute code with root privileges on routers using Broadcom technology. This flaw, which does not require a network password or pairing, was disclosed by security researcher Quentin Kaiser on October 16.
Details of the Vulnerability
This security loophole affects Broadcom’s implementation of Wi-Fi Protected Setup (WPS), a feature designed to facilitate easy network access. The vulnerability stems from improper handling of fragmented WPS setup messages, allowing attackers within radio range to send crafted messages that corrupt the router’s memory. By exploiting this flaw, attackers can read sensitive data such as Wi-Fi passwords and remotely execute commands on the affected devices.
Kaiser demonstrated the vulnerability using routers from three Belgian internet service providers, reading Wi-Fi credentials and opening remote shells on these devices. Despite the severity of this flaw, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned, and no patches have been released.
Impact on Routers and Devices
Broadcom’s vulnerable WPS code is embedded in numerous routers and access points globally, potentially affecting millions of devices. The flaw is found in both older eCos-based chips and newer Linux-based models. While the latter could be patched with updated Wi-Fi software, the former remains permanently vulnerable due to hardware limitations.
In Belgium, devices from Proximus, Orange Belgium, and VOO are confirmed to be affected. Kaiser estimates hundreds of thousands of gateways are at risk, although these numbers are rough approximations.
Lack of Patches and Mitigation Strategies
The vulnerability, traced back to at least 2010, received an incomplete fix in 2018 from Broadcom, advising customers to use alternative Wi-Fi software. The absence of a CVE has hindered coordinated response efforts, with Broadcom declining to publicly acknowledge the issue.
Without available patches, defenders are advised to use YARA rules and scripts provided by Kaiser to identify vulnerable devices. For devices that cannot be patched, replacement is the recommended course of action. This vulnerability is particularly concerning for attacks initiated over Wi-Fi rather than through internet connections.
As the situation unfolds, the cybersecurity community continues to advocate for comprehensive solutions to mitigate risks associated with this and similar vulnerabilities.
