A newly disclosed flaw in Broadcom’s Wi-Fi setup software can allow attackers within wireless range to recover network passwords or open remote shells without authentication, leaving millions of routers potentially exposed.
Security researcher Quentin Kaiser has disclosed a serious flaw in Broadcom’s Wi-Fi setup software that can let an attacker within wireless range take control of affected routers as root, without knowing the network password or completing any pairing step. In his disclosure on 16 October, Kaiser said he had demonstrated the attack against home gateways supplied by three Belgian internet providers, including one case in which the Wi-Fi password was recovered from the device and another in which a remote shell was opened over the air. The Hacker News reported that no CVE has been assigned and no fix has yet been deployed to the affected routers.
The weakness sits in Broadcom’s implementation of Wi-Fi Protected Setup, the mechanism designed to let devices join a wireless network without manually entering the password. According to the disclosure, the software mishandles fragmented WPS setup messages, allowing a nearby attacker to corrupt memory and then build from that primitive to read data back from the device or execute arbitrary code. The flaw appears to have been present for years; one report says it can be traced back to at least 2010, while another notes that Broadcom issued only an incomplete fix in 2018 and later advised customers to move to hostapd instead.
Kaiser said the issue affected routers and access points using Broadcom code from numerous vendors, with exposure potentially running into the millions of devices worldwide. He split the vulnerable hardware into two broad groups: older eCos-based chips, for which he found no usable remedy and described the bug as effectively permanent, and newer Linux-based chips, which could be fixed if vendors replace the wireless software stack. The Hacker News said he identified confirmed exposure in Belgium on gateways from Proximus, Orange Belgium and VOO, while a fourth major provider, Telenet, may also be affected but was not tested.
The practical impact is not limited to denial of service or limited mischief. On an Orange Belgium gateway built by Askey, Kaiser said he was able to retrieve the stored Wi-Fi key and then join the network with it. On a Proximus BBOX3V+ from Sagemcom, he demonstrated a reverse shell delivered entirely over Wi-Fi frames, removing the need for an external command server. The available evidence, however, does not indicate real-world abuse so far; the exploits were his own proof-of-concept code.
The absence of a CVE appears to have contributed to the slow response. The Hacker News reported that Broadcom had known about the bug since 2018, but had not publicly registered it or said anything about it, while Kaiser said CERT Coordination Center closed the case the same day because Broadcom holds the authority to assign CVEs for its products. For defenders, the immediate options are limited. Kaiser has published YARA rules for spotting the vulnerable code in firmware images and a script that tests a live access point for signs of the flaw, but those tools are only triage aids. For devices that cannot be updated, replacement appears to be the only realistic mitigation.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
