Broadcom Wi-Fi Vulnerability Exposes Routers to Code Execution

A Broadcom Wi-Fi vulnerability demonstrated on October 16, 2026, lets attackers within wireless range execute code on routers without knowing the network password. Dating back to at least 2010, the flaw has lingered in Broadcom’s software development kit, and by the time the disclosure deadline passed on October 15, 2026, not a single device examined in Belgium had been patched.

The WPS flaw permits unauthenticated code execution over Wi-Fi.

Belgium’s estimated exposure exceeds 1.5 million gateways.

Broadcom declined to assign a CVE, and its earlier patch was incomplete.

How the Broadcom Wi-Fi vulnerability bypasses passwords

The flaw sits in Broadcom ’s WPS implementation, specifically the code that reassembles fragmented EAP messages. A buffer overflow during that process allows memory corruption, access to sensitive data and arbitrary code execution without authentication or user interaction.

WPS allows devices to join a wireless network without entering its key. The attack bypasses WPA2 or WPA3 password protection; it does not make those protections useless.

Affected platforms include eCos devices using BCM3380, BCM3383 and BCM33834 , as well as Linux devices using BCM3390, BCM65xx and BCM68xx. The affected hardware spans ARM and MIPS architectures.

ONEKEY’s demonstration showed key theft and shell access

Quentin Kaiser, lead security researcher at ONEKEY , discovered the vulnerability and demonstrated it at the Hexacon conference in Paris on October 16, 2026. His demonstrations used two gateways deployed by Belgian operators.

On an ASKEY TCG3000 from Orange Belgium, Kaiser extracted the Wi-Fi key in cleartext from NVRAM and then connected to the network. On a Sagemcom F@st/BBOX3V+ from Proximus, he opened a remote shell using only 802.11 frames , without an internet-reachable command server.

Kaiser said the antennas were close together in the videos because of the test-bench setup, not because the attack required that spacing. It also works at a distance within Wi-Fi range.

He published a fingerprinting script and a YARA rule to help identify affected devices. Kaiser also credited artificial intelligence with accelerating the analysis, saying work that would have taken him months took less than a week with frontier models.

Belgian exposure exceeds 1.5 million gateways

Estimates for Belgium put the number of exposed gateways at more than 1.5 million , covering equipment from three major operators. The breakdown includes approximately 850,000 Proximus gateways, 500,000 in VOO’s legacy fleet and 210,000 from Orange Belgium.

The Broadcom Wi-Fi vulnerability is not confined to those Belgian deployments: the affected chips power hundreds of products worldwide. The Belgian figures quantify exposure in that market, rather than providing a worldwide device count.

An incomplete patch and a disputed disclosure process

Broadcom released an incomplete patch in 2018 and later advised switching to hostapd rather than fixing its own code. On eCos platforms, that approach leaves the vulnerability effectively unpatchable.

When contacted in July 2026, Broadcom said a patch existed and urged manufacturers to patch directly. It refused to assign a CVE. CERT/CC opened and closed its case in a single day.

The 90-day disclosure window ended on October 15, 2026, without a patch reaching any of the devices surveyed in Belgium. Broadcom has not provided a complete fix for the flaw.

The immediate countermeasures identified for the Broadcom Wi-Fi vulnerability are to disable WPS in the router’s settings, change default administrator credentials and check for firmware updates supplied by the operator.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.