Broadcom Wi-Fi Flaw Gives Root on Routers Without a Password

Security researcher Quentin Kaiser disclosed on Friday at Hexacon in Paris a vulnerability in Broadcom’s Wi-Fi software that lets an attacker within radio range execute arbitrary code as root on affected routers, without the network password and without completing a WPS enrollment.

The flaw sits in Broadcom’s proprietary WPS Monitor implementation, which has shipped in the company’s 802.11 SDK since at least 2010, according to Kaiser’s technical write-up . It carries no CVE identifier. Kaiser named it WPSplinter himself after Broadcom declined to register it, and it affects dozens of vendors, hundreds of products, and what he estimates are millions of Broadcom-based access points worldwide.

The bug is a buffer overflow in how the WPS Monitor reassembles fragmented EAP-WPS messages. Broadcom’s code does not constrain the reassembled fragment to the size of its destination buffer, so an attacker who sends crafted WPS frames can write past the end of it and corrupt memory. The parser is reachable over the air before any enrollment finishes, which means no PIN, no button press, and no pre-shared key — only proximity. Exploitation yields controlled memory disclosure and arbitrary code execution.

Kaiser filed the research as two reports covering the same parser on two platform families: Broadcom’s eCos-based SoCs (BCM3380, BCM3383, BCM33834) and its Linux-based ones (BCM3390, BCM63xx, BCM65xx, BCM68xx). On the eCos devices, he describes the bug as a permanent, forever-day bug because those products have no migration path away from the vulnerable component.

What the exploit does once it lands

Against an Askey TCG3000 gateway supplied by Orange Belgium, Kaiser’s shellcode reads the Wi-Fi pre-shared key from NVRAM and transmits it to the attacker over 802.11 frames. He then joins the network with the recovered key, demonstrating both that the extraction is accurate and that the router survives the attack intact.

Against a Proximus BBOX3V+, built by Sagemcom, the exploit opens a reverse shell carried entirely over 802.11 frames — the attacker gets an interactive command line on the gateway with no command-and-control server on the internet and no traffic traversing the WAN side, where an operator might see it.

“This attack works over long distances,” Kaiser said, cautioning readers not to read anything into how close the antennas sit in his demonstration videos.

A patch that exists but never arrived

Broadcom told Kaiser on 28 July that a patch was available and advised him to tell affected manufacturers to Broadcom directly. The company said it began replacing WPS Monitor with the open-source hostapd in 2018, and that an earlier fix shipped that year — a fix Kaiser describes as incomplete and released without public notice.

Broadcom acknowledged it had known the issue since 2018 and had received reports from other external parties, but refused to assign a CVE on the grounds that the affected software is obsolete and outside its support window. It also declined to a copy of the notification it says it sent to OEMs through its customer portal.

Kaiser opened a case with CERT/CC through VINCE on 4 August. It was closed the same day, because Broadcom is itself a CVE Numbering Authority and had no intention of assigning an identifier for its own product.

That absence is the practical problem: without a CVE, there is no advisory for OEMs to track, no entry for scanners to key on, and no line item for an ISP’s patch management process, which is a large part of why the code is still running in the field 16 years after it was introduced.

He reported the issue to Proximus via its coordinated disclosure form, attempted to Orange Belgium and VOO, and passed the report and toolkit to the Center for Cybersecurity Belgium. As of 15 October, the day before his talk, none of the devices he tested had received a patch.

Which devices are affected

Kaiser confirmed exploitation on gateways deployed by three of Belgium’s four major internet providers, and his napkin-math estimate puts roughly 1.56 million affected gateways in that country alone — 850,000 at Proximus, 500,000 across VOO’s legacy fleet, and 210,000 at Orange Belgium. He rates his confidence in those figures as medium.

The exposure is considerably wider than Belgium. The advisory’s device list names Cisco’s RV110W, RV130W, RV215W and RV340W routers and its WAP121 through WAP581 access points; TP-Link’s Archer C3150, C5400, VR600, VR900, VR1600, VR2800 and TD-VG5612; Nokia’s G-140W-H, G-240W series and G-2426G-A; ZTE’s F680 v4 and 368N; Zyxel’s VMG3312-B10A and B10B; NetComm’s NF-series gateways; Arcadyan’s VRV9517; Comtrend’s VG8050; MitraStar’s GPT-2541GNAC; and hardware from ARRIS, Huawei, Netgear, Technicolor, Askey, CastleNET and Tenda.

Operators listed as deploying affected models include Movistar/Telefónica, Türk Telekom, Türksat Cablenet, Optus, Belong, KPN, SPARK, and SFR, with Nokia and ZTE models recorded simply as being in service with multiple operators worldwide.

Kaiser stresses the list is neither exhaustive nor uniformly confirmed, since firmware and hardware revisions vary within a single model number.

What defenders should do

Disabling WPS in the router’s web interface is not a reliable fix, and Kaiser says so explicitly: a settings toggle may not remove or fully disable the vulnerable parser. Several reports published since Friday have recommended it as a mitigation anyway.

Device owners should instead ask their OEM or ISP whether a firmware update addresses this specific component, and operators running eCos-based cable gateways should assume that replacement, rather than patching, is the only route.

For organizations that need to inventory their own estate, Kaiser has published a detection toolkit containing three YARA rules for ELF32 ARM and MIPS binaries — including one that matches the opcode shape of the vulnerable fragment-reassembly path — and a Scapy-based script that fingerprints a live access point over the air and returns a vulnerability assessment. He treats both as triage aids rather than proof, and is accepting pull requests to extend the affected-device list.

One footnote from the research that security teams should sit with: Kaiser says the work would have taken him months on his own, and that frontier models compressed it to under a week. The same economics apply to whoever looks .

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!