A weakness in Broadcom’s WPS software development kit may enable nearby attackers to execute code, recover wireless keys and take control of more than 1.5 million routers in Belgium alone.
A long-standing flaw in Broadcom’s proprietary Wi-Fi software may allow attackers within range of a vulnerable router to execute code without entering the network password, according to research presented by security researcher Quentin Kaiser at Hexacon in Paris. The issue affects Broadcom’s 802.11 implementation in the company’s software development kit, which Kaiser said has contained the weakness since at least 2010 and was only partially addressed in a silent 2018 update. He described the result as a weakness that can be triggered remotely over Wi-Fi without normal WPS enrolment or knowledge of the wireless key.
The flaw sits in the WPS EAP reassembly logic used during wireless setup, a part of the stack that many consumer routers rely on. In practice, that means an attacker nearby does not need the Wi-Fi password, nor any user interaction, to reach code execution on the device. In Kaiser’s demonstration, the exploit was able to recover the router’s pre-shared key from memory and transmit it back over the wireless link, after which the researcher used it to join the network.
Kaiser showed the attack working against two Belgian internet provider devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. He also demonstrated a reverse shell obtained over Wi-Fi frames alone, without requiring an internet-reachable command-and-control server. According to the reporting, the close antenna placement seen in the video was only for laboratory convenience and was not a requirement for exploitation, which raises the practical concern that the attack could be carried out from a greater distance.
Broadcom’s response appears to have left many affected systems in limbo. Kaiser said he reported the issue to the company in July 2026, after which Broadcom told him a patch existed and advised affected device makers to contact it directly. He said the company declined to assign a CVE or share the customer notice it had issued, while CERT/CC opened and then closed a case the same day after confirming Broadcom could issue identifiers itself. According to the reporting, Broadcom had previously recommended migration to hostapd rather than providing a full fix for its own stack.
The scale of exposure may be significant. Kaiser’s estimate, based on Belgian telecom market data, suggests about 850,000 Proximus devices, 500,000 legacy VOO units and 210,000 Orange Belgium gateways could be affected, taking the total in one market to more than 1.5 million routers. The chipsets involved are also used far beyond Belgium, which means the real global footprint is likely larger, although no complete inventory is yet available. Kaiser said he plans to publish fingerprinting tools and a YARA rule to help defenders identify affected deployments, while warning that AI-assisted analysis had shortened the time needed to find the bug from months to less than a week.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
