A vulnerability within Broadcom’s Wi-Fi software, dating back 16 years, has been identified, allowing attackers within wireless range to potentially seize control of susceptible routers without requiring the network password.
Discovery and Details of the Flaw
Security expert Quentin Kaiser revealed the flaw during the Hexacon event in Paris on October 16, 2026. His findings highlight how outdated code continues to be embedded in numerous commonly used devices. According to Kaiser’s analysis, the vulnerability has been part of Broadcom’s software development kit since at least 2010, impacting its proprietary implementation of the Wi-Fi Protected Setup (WPS).
This flaw allows for memory leaks and the execution of attacker-controlled code prior to the completion of the typical WPS enrollment process. The root of the issue lies in the code responsible for assembling fragmented Extensible Authentication Protocol messages utilized by WPS. Inadequate length checks enable malicious wireless messages to overflow a memory buffer.
Potential Exploits and Demonstrations
Attackers exploiting this flaw can read or alter memory and redirect the router’s program flow to execute their own code. This type of attack is conducted over-the-air and does not involve cracking passwords, although the attacker must be within wireless range of the target. Kaiser showcased this vulnerability by extracting the saved Wi-Fi password from an Orange Belgium ASKEY TCG3000 router and transmitting it back using wireless frames, subsequently joining the network with the stolen credentials.
In a second demonstration, Kaiser accessed a remote command shell on a Proximus BBOX3V+ router over Wi-Fi frames without needing a cloud command server, highlighting that a robust password alone cannot prevent exploitation of the affected software.
Impact and Industry Response
Devices from three Belgian internet providers, including Proximus, VOO, and Orange, have been confirmed vulnerable, affecting models such as Proximus BBOX3V+, Netgear CG3100 and CG3700 from VOO, and Technicolor TC7210 and CGA4233, among others. Kaiser’s estimates suggest around 1.56 million gateways in Belgium may be affected, with the potential for millions more worldwide, though exact numbers remain undetermined.
This revelation follows previous security concerns related to Broadcom’s wireless products, such as the Kr00k Wi-Fi vulnerability. Kaiser criticized the 2018 patch, describing it as incomplete. Broadcom, aware of the issue for years, has offered alternative software solutions based on hostapd and WPA Supplicant since 2018, placing the onus on device manufacturers to update their implementations.
Kaiser reported issues with eCos on July 18 and Linux on July 27, but Broadcom has yet to assign a CVE, and affected devices in Belgium remain unpatched as of mid-October. His toolkit for detecting vulnerabilities includes a wireless fingerprinting script and YARA rules for firmware checks, intended as preliminary screening tools rather than conclusive proof of exploitability.
Future Considerations and Recommendations
This flaw brings renewed attention to Nearest-Neighbor attacks, where compromised systems within proximity can provide the necessary wireless reach for attacks. Although using different methodologies, this demonstrates the significance of nearby Wi-Fi exposure. Users are advised to update their defenses against emerging malware promptly and integrate Threat Intelligence Feeds with data from 16,000 Security Operations Centers (SOCs) to enhance protection.
