Decade-old Broadcom Wi-Fi flaw leaves millions of routers exposed without a CVE

A vulnerability in Broadcom’s WPS parsing code may allow attackers within wireless range to execute code on widely deployed routers, while the lack of a CVE complicates efforts to identify and patch affected devices.

A long-running flaw in Broadcom Wi-Fi software may leave a wide range of routers open to attack by anyone within wireless range, according to reporting from Enterprise Security Tech and later coverage by TechSpot and The Verge. Security researcher Quentin Kaiser traced the weakness to Wi-Fi Protected Setup parsing code dating back to at least 2010. In testing, he was able to demonstrate code execution on routers supplied by major Belgian internet providers, raising concern that a bug first introduced many years ago is still present in equipment that remains in active use.

The issue is notable not only for its age but also for the way it has been handled. Broadcom reportedly acknowledged the underlying defect but declined to issue a CVE identifier, saying the software was obsolete. That creates a practical problem for defenders: without a standard vulnerability label, scanners, asset-management tools and patch-tracking systems may be less likely to flag exposed devices. As TechSpot noted, the absence of a CVE can make remediation harder to organise across large fleets.

The scale of the risk is difficult to pin down precisely because exposure depends on the router model and the firmware installed on it. Kaiser estimated that roughly 1.56 million devices may be affected in Belgium alone, though the broader impact could extend beyond that market because the same Broadcom components are used across products from multiple manufacturers. Some vendors already have patches available, but unsupported devices may have no fix at all and may need to be replaced. The presence of Broadcom software on a router does not, by itself, prove that the device is vulnerable.

Security specialists say the exposure should be treated as a network-hardware management problem rather than a simple password issue. Because the flaw can be reached before normal authentication, changing the Wi-Fi password is not enough to close it. Internet providers and enterprise teams are being advised to identify affected hardware, obtain the latest firmware from the device maker and retire equipment that no longer receives security support. As Seemant Sehgal, founder and chief executive of BreachLock, put it: “This is not the first case of software being classified as obsolete but still deployed in millions of devices, and it will not be the last.”