A vulnerability in Broadcom's Wi-Fi setup software allows an attacker within wireless range to execute code with root privileges on Broadcom-based routers, without needing the network password or completing any pairing process, security researcher Quentin Kaiser disclosed on October 16. He demonstrated the attack against home gateways provided by three Belgian internet service providers, in one instance extracting the Wi-Fi password from the device and in another establishing a remote shell over the air. According to Kaiser, no CVE identifier has been assigned to the vulnerability, and no fix has been deployed to the affected routers.
The flaw exists in Broadcom's implementation of Wi-Fi Protected Setup, the feature that allows devices to connect to a Wi-Fi network without manually entering the password. Broadcom's code incorrectly handles the reassembly of fragmented WPS setup messages, enabling an attacker within range to transmit specially crafted messages that corrupt the router's memory. Kaiser built two exploitation methods from this foundation: one that reads memory back from the device, and another that executes his own code on it. Against an Orange Belgium gateway, the Askey TCG3000, the exploit retrieved the Wi-Fi password from the router's stored configuration, transmitted it back over the air, and then connected to the network using it. Against a Proximus gateway, the Sagemcom-built BBOX3V+, the exploit established a reverse shell carried over Wi-Fi frames, requiring no external server. Both attacks ran without any authentication, and the attack functions at a distance, not only at close range, Kaiser says. He reports no real-world attacks exploiting the flaw.
Broadcom's WPS code is embedded in routers and access points from dozens of manufacturers, and Kaiser estimates millions of devices worldwide are affected. The vulnerable chips fall into two categories: older eCos-based models including the BCM3380, BCM3383 and BCM33834, where he found no usable fix and labels the bug a permanent "forever day," meaning a flaw that will never be patched on those devices, and newer Linux-based models including the BCM3390, BCM65xx and BCM68xx, which could be fixed if their manufacturers switch Wi-Fi software. The flaw is old, Kaiser traces the code back to at least 2010, and says Broadcom shipped an incomplete fix in 2018, then instructed customers to migrate to a different Wi-Fi software package called hostapd rather than depending on the fix. On the older eCos chips, no working fix was ever shipped, which is why he calls it a forever day. Kaiser says Broadcom told him it has known about the bug since 2018 and had heard about it from others, but would not register a CVE or make any public statement, which he believes is why so many device makers never patched. When he escalated the case to the CERT Coordination Center, it was closed the same day, because Broadcom itself holds the authority to assign CVEs for its products and declined to do so.
The absence of both a patch and any setting that blocks the attack over the air leaves replacement as the practical option for gear that will never be fixed. Kaiser provides tools to identify affected equipment: YARA rules that detect the vulnerable code in extracted firmware, and a script that monitors a live access point and reports whether it appears vulnerable, though both are triage aids rather than definitive tests. The bug is well suited to attackers who reach a target over nearby Wi-Fi rather than the internet, a technique Russian state hackers have used to breach networks from across the street, Kaiser notes. In Belgium, Kaiser found the flaw present and exploitable on gateways from three of the four major providers: Proximus, Orange Belgium and VOO, with per-provider counts running into the hundreds of thousands of gateways, though these are rough estimates. The wireless attack surface becomes more dangerous when vendors rely on closed-loop disclosure processes that prevent public awareness, and when chip manufacturers decline to issue tracking identifiers that would enable coordinated patching across the supply chain.