A critical, persistent vulnerability in Broadcom ’s proprietary Wi-Fi stack, specifically within the Wi-Fi Protected Setup (WPS) implementation, enables unauthenticated attackers within wireless range to execute arbitrary code as root on millions of routers globally. This flaw, known as WPSplinter , has existed since at least 2010 and remains unpatched on a vast number of devices, with no CVE assigned by Broadcom . Exploitation has been publicly demonstrated, notably against major Belgian ISPs’ routers, allowing attackers to fully compromise affected devices, extract credentials, and pivot into internal networks. The lack of comprehensive vendor response and the absence of a CVE have left a significant attack surface exposed, making immediate risk assessment and mitigation essential for all organizations relying on affected hardware.
Technical Information
The WPSplinter vulnerability resides in the proprietary WPS protocol parser implemented by Broadcom across both eCos-based (such as BCM3380 , BCM3383 , BCM33834 ) and Linux-based ( BCM3390 , BCM65xx , BCM68xx ) Wi-Fi chipsets. The flaw is triggered by a malformed WPS EAP (Extensible Authentication Protocol) reassembly, which leads to a buffer overflow condition. An attacker, without requiring authentication or knowledge of the Wi-Fi password, can send specially crafted Wi-Fi frames to the target router. This results in remote code execution with root privileges.
The vulnerability was first publicly disclosed by * at Hexacon, Paris, on October 16, 2026. Despite an incomplete patch issued by *Broadcom in 2018, most OEMs and ISPs have not deployed effective fixes. Broadcom recommends migration to hostapd for Linux-based platforms, but eCos-based platforms remain unpatchable, effectively rendering them “forever day” vulnerabilities.
The impact of exploitation is severe: attackers can extract Wi-Fi pre-shared keys (PSKs) from NVRAM, establish reverse shells over Wi-Fi frames (bypassing the need for internet-based command and control), modify firmware for persistent access, and harvest credentials for lateral movement within internal networks. The attack is viable at standard Wi-Fi distances, making it practical for adversaries in urban environments, hotels, or any location with dense router deployment.
A partial list of affected devices includes Proximus BBOX 3 and BBOX 3V+ (Sagemcom F@st) , VOO Netgear CG3100 , CG3700 , Technicolor TC7210 , CGA4233 , Orange Belgium ASKEY TCG3000 , and suspected Telenet Sagemcom F@st models. The global exposure is estimated in the millions, with approximately 1.5 million routers confirmed vulnerable and unpatched in Belgium alone.
Exploitation in the Wild
Exploitation of WPSplinter has been demonstrated in the wild. * published live exploit videos showing unauthenticated remote code execution on *Orange Belgium and Proximus routers. Attack scenarios include credential theft (Wi-Fi PSK extraction), unauthorized network access, lateral movement, and the deployment of wormable implants in dense environments. The attack does not require authentication, WPS handshake completion, or knowledge of the Wi-Fi password, making it highly accessible to adversaries with physical proximity.
The exploit chain involves sending malformed WPS EAP frames to the target device, triggering the buffer overflow and achieving root code execution. Payloads observed include extraction and exfiltration of Wi-Fi credentials and the establishment of reverse shells over Wi-Fi management frames. Persistence is achieved through firmware modification, enabling long-term compromise and facilitating further attacks within the victim’s network.
APT Groups using this vulnerability
As of the time of writing, there is no public attribution of WPSplinter exploitation to specific Advanced Persistent Threat (APT) groups. However, the technical characteristics and operational flexibility of this vulnerability make it highly attractive to both state- and criminal actors. The attack surface includes ISPs, hospitality providers, urban Wi-Fi deployments, and any organization or individual using affected routers. The tactics, techniques, and procedures (TTPs) align with MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application), T1210 (Exploitation of Remote Services), and T1078 (Valid Accounts, if credentials are stolen). Given the ease of exploitation and the potential for mass compromise, it is likely that sophisticated threat actors will incorporate this vulnerability into their toolkits if they have not already done so.
Affected Product Versions
The following vendors and models are confirmed or strongly suspected to be affected by the WPSplinter vulnerability, based on public documentation and field reports. This list is not exhaustive; any device using the vulnerable Broadcom WPS Monitor implementation may be at risk. Firmware and hardware revisions can vary within a model, so verification is essential.
Vendors include ARRIS (SURFboard AC1200), Arcadyan (VRV9517, KPN Experia Box V10A), Askey (TCG3000, RTF3505VW), CastleNET (NetMASTER Infinity 401MP, CBW-383ZN, CBW-383Z4, CBW-700V), Cisco (RV110W, RV130W, RV215W, RV340W, WAP121, WAP125, WAP150, WAP361, WAP371, WAP571, WAP571E, WAP581), Comtrend (VG8050), Huawei (B310, B315, B593, WS880), NetComm (NF4V, NF10W, NF10WV, NF8AC, NF17ACV, NF18ACV, NF18MESH), Netgear (CG3100, CG3700B), Neuf (NB6, NB6VAC), Nokia (G-140W-H, G-240W series, G-2426G-A), Sagemcom (F@ST 3864, 3864OP, 4353, 5336), Technicolor (TC7210, CGA4233), Tenda (D301, N300), TP-Link (VR1600, TD-VG5612, Archer C3150, C5400, VR600, VR900, VR2800), ZTE (F680 v4, 368N), Zyxel (VMG3312-B10A, VMG3312-B10B), and MitraStar (GPT-2541GNAC). For a current, community-maintained list and device reporting instructions, refer to the WPSplinter public documentation .
Workaround and Mitigation
The patch status for WPSplinter is highly unsatisfactory. Broadcom issued an incomplete patch in 2018, but most OEMs and ISPs have not deployed it. For Linux-based platforms, Broadcom recommends migration to hostapd , which is not vulnerable. However, eCos-based platforms remain unpatchable, representing a permanent risk. Organizations should use the public fingerprinting tools and YARA rules provided by **** to identify affected devices in their environments. Immediate steps include contacting ISPs or device OEMs to demand urgent firmware updates or device replacement, segmenting vulnerable Wi-Fi networks from sensitive internal resources, and monitoring for anomalous Wi-Fi management traffic and unauthorized device access. Where possible, replace unpatchable hardware with devices running supported, actively maintained firmware.
Indicators of Compromise
The following indicators are provided as a point-in-time reference and should be validated before enforcement in your environment. They are derived from public technical disclosures and research related to WPSplinter .
qkaiser[.]github[.]io
hxxps://qkaiser[.]github[.]io/broadcom-wps/
hxxps://quentinkaiser[.]be/security/2026/10/16/one-parser-two-bugs/
: One Parser, Two Bugs, Many Routers (Technical Write-up)
WPSplinter Public Documentation and Tools
International Cyber Digest Twitter Thread
CSO Online: High-severity bug in Broadcom software enables easy WiFi denial-of-service
Black Duck Blog: Broadcom Wi-Fi Chipset Vulnerability
Rescana is here for you
Rescana empowers organizations to proactively manage third-party risk with our advanced TPRM platform, providing continuous visibility, automated assessments, and actionable intelligence to secure your digital supply chain. For further assistance or a tailored assessment of your organization’s exposure, we are happy to answer questions at [email protected].
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
