Broadcom Wi

Security researcher Quentin Kaiser disclosed an unpatched vulnerability in Broadcom's Wi-Fi Protected Setup code that allows attackers within radio range to execute root-level commands on routers without a password or pairing step.

Security researcher Quentin Kaiser disclosed an unpatched Broadcom Wi-Fi vulnerability on Oct. 16 that lets attackers within radio range run code as root on routers without a network password or pairing step. The flaw sits in Broadcom's version of Wi-Fi Protected Setup, the feature that lets devices join a network without typing a password.

Broadcom's code mishandles reassembly of fragmented WPS setup messages. An attacker in range sends crafted messages that corrupt router memory. Kaiser built two exploits from that corruption: a memory read tool and a code execution path.

Against an Orange Belgium gateway, the Askey TCG3000, the exploit read the Wi-Fi password from stored settings, transmitted it over the air, and joined the network with it. Against a Proximus gateway, the Sagemcom BBOX3V+, the exploit opened a reverse shell carried over Wi-Fi frames. The attack required no outside server.

Both exploits required no login and worked at a distance. Kaiser reports no real-world attacks using the flaw; he built the working exploits himself.

Kaiser estimates millions of devices worldwide are affected. The vulnerable chips fall into two families: older eCos-based models such as the BCM3380 and BCM3383, and newer Linux-based models such as the BCM3390 and BCM65xx. On the older chips, Kaiser found no usable fix and calls the bug a permanent "forever day." The newer chips could be fixed if manufacturers switch Wi-Fi software.

In Belgium, Kaiser found the flaw present and exploitable on gateways from three of four major providers: Proximus, Orange Belgium and VOO. Telenet may be affected too, but he could not test a gateway from that provider. He estimates hundreds of thousands of gateways per provider in Belgium, though these counts are rough. He published a wider list ranging from Cisco small-business access points to Huawei and ARRIS routers, though some entries rest on automated checks that only flag devices as likely vulnerable.

The flaw is old. Kaiser traces the code back to at least 2010. Broadcom shipped an incomplete fix in 2018, then told customers to switch to hostapd rather than rely on the patch. On older eCos chips, no working fix was ever shipped.

No one has assigned a CVE to track the flaw. Broadcom said it has known the bug since 2018 and heard it from others, but refused to register a CVE or speak publicly. Kaiser said this silence explains why so many device makers never patched. When he took the case to CERT, the center closed it the same day because Broadcom holds the authority to assign CVEs for its products and would not do so.

There is no patch to install and no setting that blocks the attack over the air. Kaiser provides YARA rules that spot vulnerable code in extracted firmware and a script that listens to a live access point and reports whether it looks vulnerable. Both are triage aids; a patched device can still match the rules, so a hit requires further checking, not a confirmed finding. For gear that will never be fixed, replacement is the practical option.

Kaiser frames the bug as well suited to attackers who reach targets over nearby Wi-Fi rather than the internet. Russian state hackers have used this technique to breach networks from across the street.

Source : thehackernews.com