A vulnerability in ageing Wi-Fi Protected Setup code, first identified in 2010, remains exploitable on some French and Belgian internet boxes, highlighting years of weak firmware maintenance.
A long-known weakness in Broadcom Wi-Fi chips is still exposing some home routers and internet boxes to attack within wireless range, without the victim needing to enter a password. The flaw sits in an ageing implementation of Wi-Fi Protected Setup, the feature designed to let devices join a network with a push-button exchange rather than a manual key. According to Clubic, the issue has existed since 2010 and was only partly addressed in 2018, leaving a wide installed base dependent on whether manufacturers later pushed proper firmware fixes.
In tests carried out around Paris, researcher Quentin Kaiser found that Orange’s Livebox 5, in its Sagemcom Fast5656 variant, and SFR’s Box Plus, in the NB6VAC version, were still unpatched. By contrast, Orange’s Livebox 6 and Bouygues Telecom’s latest Wi-Fi 7 Bbox appeared to have been corrected, while no Freebox model showed up in the measurements. The researcher stressed that a model name alone does not prove every unit is vulnerable, because the same product can ship in different hardware or software variants.
Kaiser said he did not work alone: artificial intelligence agents helped him map and analyse the problem, at a cost he put at 103 euros. He wrote that, using advanced AI models, the investigation took less than a week. The same research also extended beyond France. In Belgium, he said he was able to take control of an Orange Belgium box and recover its Wi-Fi key, then gain command-line access to a Proximus device, leading him to estimate that about 1.5 million boxes in the country could be affected.
The case echoes other long-lived Wi-Fi security failures. Tom’s Hardware recently reported on the “Pixie Dust” exploit, first made public in 2014, which still remained unpatched in devices from six manufacturers, including routers, access points and wireless extenders. Security specialists say the common thread is not just a single bug, but a broader weakness in consumer networking equipment: slow firmware maintenance, unclear patch notes and outdated security logic that can linger for years after a flaw becomes public.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
