Unpatched Broadcom Wi-Fi Vulnerability Could Give Nearby Attackers Root Access to Routers

A security vulnerability in Broadcom’s Wi-Fi Protected Setup (WPS) software could allow attackers within wireless range to execute code with root privileges on affected routers without requiring a Wi-Fi password, user authentication or a pairing process.

The vulnerability was disclosed on October 16, 2026, by security researcher Quentin Kaiser, who demonstrated successful exploitation against home internet gateways supplied by three Belgian internet service providers.

According to Kaiser, the flaw could enable attackers to extract sensitive information from vulnerable routers or obtain remote command-line access through wireless signals. He also reported that, as of his disclosure, the affected devices had not received a working security fix and no Common Vulnerabilities and Exposures (CVE) identifier had been assigned.

The weakness affects Broadcom’s implementation of WPS, a feature designed to make it easier for devices to connect to Wi-Fi networks without manually entering the network password.

Kaiser discovered that the software mishandles fragmented WPS setup messages. By transmitting specially crafted messages, an attacker within radio range could trigger memory corruption in a vulnerable router. This could then be exploited to read information from the device or execute unauthorised code.

In one demonstration involving an Askey TCG3000 gateway supplied by Orange Belgium, the researcher showed that the vulnerability could be used to retrieve the Wi-Fi pre-shared key (PSK) stored on the router. With the password exposed, an attacker could subsequently connect to the wireless network.

A second demonstration targeted the Sagemcom-built BBOX3V+ gateway used by Proximus. In that case, Kaiser demonstrated how the exploit could establish a reverse shell, providing remote command-line access through Wi-Fi frames without requiring a connection to an external server.

The researcher said both demonstrations worked without authentication. He also noted that exploitation did not require an attacker to be physically close to the router, provided the device was within the necessary wireless range.

However, Kaiser reported no confirmed real-world attacks involving the vulnerability at the time of disclosure. The demonstrations were conducted using exploits he developed himself.

Millions of Routers Could Be Exposed

Broadcom’s WPS implementation has been incorporated into routers and wireless access points produced by numerous manufacturers. Kaiser estimates that millions of devices worldwide could potentially be affected.

The vulnerable hardware identified in his research falls into two broad categories: older eCos-based platforms and newer Linux-based devices.

The older platforms include the BCM3380, BCM3383 and BCM33834 chip families. Kaiser said he could not identify a usable fix for the affected older devices, describing the situation as a “forever day” vulnerability because the flaw may remain unpatched throughout the devices’ operational lifetimes.

The newer platforms include the BCM3390, BCM65xx and BCM68xx families. According to the researcher, these devices could potentially be secured if manufacturers replace the vulnerable wireless software with an alternative implementation, such as hostapd.

In Belgium, the researcher confirmed that gateways associated with Proximus, Orange Belgium and VOO were affected and exploitable during his testing. He could not test equipment from Telenet, leaving its status uncertain.

His published list of potentially affected equipment also includes devices associated with manufacturers such as Cisco, Huawei and ARRIS. However, the entries do not all have the same level of verification. Some devices were confirmed through testing, while others were identified through automated checks that indicate a likelihood of vulnerability rather than conclusive proof.

Kaiser estimates that the number of potentially affected gateways at individual Belgian providers could reach hundreds of thousands. Those figures remain approximate rather than a verified count of vulnerable devices.

Why the Vulnerability Remains Unpatched

The vulnerability appears to have existed for years. Kaiser traced the affected code back to at least 2010 and said Broadcom distributed an incomplete fix in 2018.

According to his account, Broadcom subsequently advised customers to move to a different Wi-Fi software implementation, hostapd, instead of relying on the incomplete correction.

The researcher said the older eCos-based platforms never received a working fix, leaving affected equipment exposed unless it is replaced or otherwise removed from service.

The absence of a CVE identifier has also complicated efforts to track the issue across manufacturers and products. CVE identifiers provide a standard reference for publicly disclosed security vulnerabilities, helping vendors, security teams and users identify and monitor risks.

Kaiser said Broadcom had been aware of the problem since 2018 but declined to assign a CVE identifier or make a public announcement about it. He believes this contributed to the failure of numerous device manufacturers to address the vulnerability.

The case was also submitted to the CERT Coordination Center, but Kaiser said the report was closed on the same day because Broadcom, as the relevant product vendor, controlled the CVE assignment process and would not register the issue.

As of October 19, 2026, The Hacker News reported that it could not find a CVE identifier assigned to the vulnerability.

The lack of a formal identifier does not mean the weakness is harmless. Rather, it can make it more difficult for organisations to establish whether their equipment is affected and determine whether a manufacturer has provided an appropriate remedy.

How Organisations Can Identify Vulnerable Devices

With no broadly available patch identified in the disclosure, administrators may need to establish whether their routers contain the vulnerable code before deciding on further action.

Kaiser has published YARA rules through a GitHub repository to help security professionals identify potentially vulnerable Broadcom WPS code in extracted firmware. He also provided a script that examines wireless traffic from a live access point and reports whether the device appears vulnerable.

These tools are intended to assist with initial investigation and prioritisation. They do not guarantee a definitive result: a device that has received a fix could still match a detection rule, meaning any positive result should be examined further.

Network administrators should therefore confirm the exact router model, hardware platform and firmware version, and contact the equipment manufacturer or internet service provider for information about available security updates and replacement options.

Where a device is confirmed to be vulnerable and no effective remediation exists, replacing it with supported equipment may be the most practical long-term measure.

Organisations should also maintain an inventory of routers and wireless access points, monitor vendor security announcements and avoid assuming that equipment supplied by an internet provider is automatically protected against every newly disclosed weakness.

A Warning About Attacks Through Nearby Wireless Networks

The vulnerability highlights the security risks posed by wireless equipment that can be reached from outside an organisation’s premises.

Although many cybersecurity incidents begin with internet-facing services, attackers may also exploit devices through nearby wireless networks. Such approaches can allow an intruder to target equipment without first gaining access through the organisation’s public-facing infrastructure.

Kaiser pointed to previous incidents in which Russian state-linked hackers reportedly used nearby Wi-Fi networks to gain covert access to target environments. The technique illustrates how attackers may exploit wireless proximity to bypass some conventional network boundaries.

For home users and businesses, routers remain a critical security layer because they connect local devices to external networks and often handle sensitive configuration information. A vulnerability that permits unauthenticated code execution at root level can potentially give an attacker extensive control over an affected device.

Until manufacturers provide effective remediation or vulnerable hardware is replaced, identifying affected equipment and obtaining guidance from the responsible vendor or internet service provider will be important steps in reducing exposure.

The findings also underline the need for hardware manufacturers to communicate security issues clearly and provide long-term support for devices that remain deployed in homes and business networks.