A weakness in Broadcom’s long-running Wi-Fi software can expose network keys and enable remote shell access without the Wi-Fi password, while patching remains dependent on internet service providers.
A security researcher has exposed a long-running flaw in Broadcom’s Wi-Fi software that can let an attacker within radio range take control of a router without knowing the network password. Quentin Kaiser disclosed the issue at the Hexacon conference in Paris, describing a weakness in the Wi-Fi Protected Setup function, or WPS, which is meant to simplify device pairing. According to The Register and other security outlets, the problem has existed in Broadcom code since at least 2010 and remains relevant because many routers and gateways still rely on the chipmaker’s software stack.
Kaiser’s demonstrations showed that the bug is not merely theoretical. On one Belgian Orange gateway, he was able to extract the Wi-Fi key from the device’s memory and transmit it over the air, then join the network. On a Proximus box, he reportedly achieved remote shell access through Wi-Fi frames alone. Reports from The Register and Techzine say the vulnerability stems from Broadcom’s handling of WPS messages, where malformed traffic can trigger memory corruption and allow arbitrary code execution. The attack does not require a completed WPS enrolment, only proximity to the target network.
Broadcom has been aware of the issue for years, but the handling of the disclosure has left many unanswered questions. According to The Register, the company says it replaced the older code with a hostapd-based implementation from 2018, yet Kaiser argues that the change did not fully remove the weakness. He also says Broadcom declined to assign a CVE identifier and did not publish the security notice it told him had been sent to manufacturers. That matters because, without a CVE, the flaw is harder for defenders and scanning tools to track.
The practical problem now lies with patch distribution. The fix depends not only on whether the manufacturer adopted Broadcom’s newer code, but also on whether the internet service provider has pushed updated firmware to end-users. Security reports say that Belgian devices from Orange Belgium, Proximus and VOO remained unpatched at the time of disclosure, while some French boxes shown in Kaiser’s slides were already marked as patched and others were not. For older platforms based on eCos, Kaiser describes the flaw as effectively permanent. He also published a detection script for users testing their own equipment, while warning that disabling WPS may not be enough on its own. In practice, affected users are being advised to check for firmware updates, change default administrative credentials and, where necessary, use a separate router rather than relying on the provider’s box.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
