A researcher says a Broadcom WPS flaw lets nearby attackers run code as root on millions of routers, with no CVE or fix.
A long-standing flaw in Broadcom's Wi-Fi setup software can let an attacker within radio range take full control of Broadcom-based routers — without knowing the network password or completing any pairing step. Security researcher Quentin Kaiser disclosed the issue on October 16, demonstrating it against home gateways from three Belgian internet providers. According to Kaiser, no CVE tracking number has been assigned and no fix has reached the affected routers.
Kaiser published research showing that Broadcom's version of Wi-Fi Protected Setup (WPS) — the feature that lets a device join a Wi-Fi network without typing the password — mishandles how it reassembles fragmented setup messages. An attacker in range can send specially crafted messages that corrupt the router's memory. From that foothold, Kaiser says he built two capabilities: a way to read memory off the device, and a way to run his own code on it with the highest level of system access, known as "root."
He demonstrated two separate outcomes. Against an Orange Belgium gateway (the Askey TCG3000), his exploit read the stored Wi-Fi password — the "PSK," or pre-shared key — sent it back over the air, and then joined the network. Against a Proximus gateway (the Sagemcom-built BBOX3V+), the exploit opened a reverse shell — a remote command line delivered over Wi-Fi frames, meaning no outside internet server was needed. Both worked with no login, and Kaiser says the attack functions at a distance, not just up close.
Kaiser reports no real-world attacks using the flaw. The working exploits, he says, are his own.
Broadcom's WPS code is embedded in routers and access points from dozens of vendors, and Kaiser estimates that millions of devices worldwide are affected. He divides the vulnerable chips into two families:
In Belgium, he found the flaw present and exploitable on gateways from three of the four major providers: Proximus, Orange Belgium and VOO. A fourth, Telenet, may also be affected, but Kaiser could not test a device. He estimates the per-provider counts run into the hundreds of thousands of gateways, while stressing these are rough figures.
Kaiser also published a wider list spanning Cisco small-business access points, Huawei and ARRIS routers. That list mixes confirmed and unconfirmed entries, and some rely on an automated check that only flags a device as "likely vulnerable" rather than confirming it.
WPS was designed to make joining Wi-Fi easier. Instead of typing a long password, a device can exchange a short series of setup messages with the router to get onto the network. Those messages can be split into pieces — "fragments" — and the router reassembles them.
The problem, Kaiser says, is that Broadcom's code does not handle that reassembly correctly. By sending carefully malformed fragments, an attacker can cause the router to overwrite parts of its own memory. Memory corruption like this can be steered to leak stored data (such as the Wi-Fi password) or to trick the device into running attacker-supplied instructions. Because WPS listens over the air and does not require authentication first, the attacker never needs the password or any pairing approval to begin.
The flaw is old. Kaiser traces the vulnerable code back to at least 2010. He says Broadcom shipped an incomplete fix in 2018, then advised customers to switch to a different Wi-Fi software package called hostapd rather than rely on that patch. On the older eCos chips, he says, no working fix was ever shipped — the reason he labels it a "forever day."
On its face, the flaw is severe: it allows remote code execution as root, requires no credentials, and works at a distance over Wi-Fi. Reading the Wi-Fi password alone would let an attacker join and monitor a home network; a root shell would give far broader control of the gateway.
Crucially, there is no CVE — the standard tracking identifier that lets defenders and vendors follow a flaw. Kaiser says Broadcom told him it has known about the bug since 2018 and had heard of it from others, but would not register a CVE or comment publicly — which he believes is why many device makers never patched. When he took the case to the CERT Coordination Center, he says it was closed the same day, because Broadcom itself holds the authority to assign CVEs for its products and declined to do so. The Hacker News reported finding no CVE for the flaw as of October 19.
Kaiser frames the bug as well suited to attackers who reach a target over nearby Wi-Fi rather than the internet — a technique he notes Russian state hackers have used to breach networks "from across the street." As of his disclosure, there are no reports of the flaw being exploited in the wild.
There is no patch to install and, Kaiser says, no setting he points to that reliably blocks the attack over the air. That makes the practical response unusually limited. Based on the source material:
ITVedas view: a credentialless, over-the-air root exploit against hardware sitting in millions of homes is about as serious as router flaws get, and the absence of a CVE makes it harder — not easier — for the industry to coordinate a response. When a vendor's own CVE authority becomes a reason a bug goes untracked for years, the tracking system itself starts to look like part of the problem.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →