Broadcom WPS flaw leaves hundreds of millions of routers exposed to nearby attackers

A legacy Broadcom Wi-Fi component can reportedly expose wireless keys or provide code execution before authentication, affecting equipment used by providers and manufacturers worldwide.

Security researcher Quentin Kaiser has drawn attention to a Broadcom Wi-Fi flaw that could leave millions of routers exposed to attack from within radio range, even when owners have chosen strong passwords and disabled ordinary remote access. The issue, which he has named WPSplinter, centres on legacy code used for Wi-Fi Protected Setup, the push-button feature that lets devices connect without typing a password. According to TechSpot, the bug allows an attacker to trigger memory disclosure or code execution by sending a carefully arranged sequence of messages over Wi-Fi.

Kaiser disclosed the flaw at the Hexacon conference in Paris on 16 October, and the details he presented suggest the risk is broader than a single brand or market. In demonstrations described by TechSpot and PCWorld, he used the weakness on an Askey TCG3000 gateway supplied by Orange Belgium to extract the wireless key from memory and then join the network. On a separate Proximus BBOX3V+ device made by Sagemcom, he obtained a shell over Wi-Fi without needing internet access on his own side. Techzine reported that the same researcher also confirmed the problem on gateways used by Proximus, Orange Belgium and VOO, giving him evidence of around 1.5 million affected devices in Belgium alone.

The deeper concern is that the vulnerable code appears to be buried in Broadcom’s older software stack, which has been reused by many router makers and internet providers. TechSpot reported that Kaiser’s incomplete model list includes equipment from Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE and Zyxel, with deployments tied to providers such as Movistar, Optus, KPN and Türk Telekom. That is why the potential global exposure is estimated in the low hundreds of millions, not merely in the millions. The flaw is also distinct from the better-known WPS PIN weakness that drew attention in the early 2010s; this problem lies in Broadcom’s implementation, not in WPS as a concept.

Broadcom told Kaiser in July that it had known about the issue since 2018 and had since replaced the old code in its software, but the researcher has said that the earlier fix was incomplete and that the vulnerable logic can still be present in deployed equipment. Broadcom also declined to request a CVE, arguing that the code was obsolete and outside support. That omission matters because, as TechSpot noted, it can keep a flaw out of the advisories and patch workflows that router vendors and ISPs depend on. Some observers have argued that device makers bear responsibility for failing to ship updates, but Kaiser’s view is that a missing CVE helps explain why the problem stayed hidden.

For owners of affected hardware, the practical advice is limited. Changing the Wi-Fi password will not stop an exploit that occurs before authentication. Disabling WPS is still sensible, although Kaiser warns that it may not fully remove the vulnerable parser from the device. His stronger recommendation is to switch off the gateway’s built-in Wi-Fi where possible, place it in bridge mode and use a separate, fully updated router. He has also published a detection script on GitHub for users who want to test their own equipment. Kaiser said AI tools helped him locate the bug in less than a week, underscoring how much faster firmware analysis has become for both defenders and attackers.