WPSplinter public documentation

qkaiser.github.io • October 19, 2026

The list below is not exhaustive. The vulnerability is in a shared Broadcom Wi-Fi software component, so other products using the affected WPS Monitor implementation may also be affected. Firmware and hardware revisions can differ within a model.

For a current, community-maintained list and device reporting instructions, see the repository’s affected-device list .

Frequently asked questions

One Parser, Two Bugs, Many Routers — technical research and disclosure timeline.

Hexacon 2026 slides — “Exploiting Broadcom WiFi Across eCos and Linux.”

Broadcom WPS detection toolkit — YARA rules, fingerprinting script, and device list.

Detection and reporting instructions .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Unpatched Broadcom Wi-Fi Flaw Allows Remote Code Execution on Millions of Routers A vulnerability in Broadcom's Wi-Fi Protected Setup (WPS) allows attackers within radio range to execute code on routers without authentication. Disclosed by researcher Quentin Kaiser at Hexacon on October 16, 2026, this flaw has existed since at least 2010 and affects millions of devices globally, including those from major brands like Cisco and Netgear. As of October 15, 2026, no patches have been deployed for the affected devices in Belgium, where approximately 1.5 million routers are estimated to be vulnerable. The vulnerability enables attackers to extract Wi-Fi passwords and gain unauthorized access to networks. Broadcom has not assigned a CVE for this issue, and previous attempts to patch it were incomplete. The flaw specifically targets the memory handling in WPS, allowing for exploitation without user interaction. Security professionals are urged to assess their devices and monitor for updates. 12 sources 65

WPSplinter public documentation

The full story

Extracted Entities

Platforms (1)

Tools (2)