Decades-old Broadcom Wi-Fi bug lets attackers hijack routers without the password

A vulnerability in Broadcom's proprietary Wi-Fi software that has been present since at least 2010 lets attackers within wireless range take over home gateways without knowing the Wi-Fi password, security researcher Quentin Kaiser disclosed at the Hexacon conference in Paris on October 16. Broadcom declined to assign a CVE identifier, and according to the researcher, none of the affected devices he tested had been patched as of October 15, leaving what he describes as a "forever day" on some platforms.

What happened

In a write-up published alongside his talk, Kaiser describes two "WPS EAP reassembly overflow" bugs in the Wi-Fi Protected Setup (WPS) handling code of Broadcom's 802.11 implementation, one affecting eCos-based chipsets and one affecting Linux-based chipsets. According to Kaiser and Security Affairs, the flaws can be triggered remotely over Wi-Fi without the network key and without completing a normal WPS enrollment, leading to controlled information disclosure and arbitrary code execution.

Security Affairs reports that in a demonstration, Kaiser extracted the Wi-Fi password from a router's memory and opened a reverse shell using only wireless frames. The researcher says the attack works over long distances. Neither source reports exploitation in the wild.

Technical details

The researcher lists the following affected chipsets:

• eCos-based: BCM3380, BCM3383, BCM33834 (described as a definitive forever day)
• Linux-based: BCM3390, BCM65xx, BCM68xx (described as a potential forever day)

According to Security Affairs, these chipsets appear in devices from dozens of vendors. Kaiser says Broadcom silently shipped an incomplete fix in 2018 and later recommended that manufacturers migrate to the open-source hostapd. On eCos platforms the issue is considered unfixable unless manufacturers migrate, while on Linux platforms the outcome depends on each manufacturer.

The disclosure timeline shows reports were sent to Broadcom PSIRT on July 18 and July 27, 2026. Broadcom replied that a patch was available and asked the researcher to contact manufacturers directly, but declined to register a CVE or share its OEM notifications. The CERT/CC case was closed on August 4 because Broadcom, a CVE Numbering Authority, had not registered one. Kaiser says he also notified Proximus, the Belgian Cyber Security Center and attempted to reach Orange and VOO.

Who is affected

Kaiser demonstrated working exploits against the Orange Belgium ASKEY TCG3000 and Proximus Sagemcom F@st/BBOX3V+ gateways. His list of affected devices also includes VOO legacy models such as Netgear CG3100, CG3700 and Technicolor TC7210, while some Telenet models remain unconfirmed. By his medium-confidence estimates, about 850,000 Proximus, 500,000 VOO and 210,000 Orange Belgium gateways may be exposed, more than 1.5 million in Belgium alone. Devices using the same chipsets elsewhere may also be affected.

What to do

Kaiser has published a fingerprinting script and a YARA rule in the qkaiser/broadcom-wps GitHub repository to help identify affected deployments. Owners of ISP-supplied gateways should check with their provider for firmware updates, and ISPs and manufacturers using the listed chipsets should assess their fleets and follow Broadcom's guidance to migrate away from the vulnerable WPS implementation. As a general hardening step not specifically stated in the sources, disabling WPS where the device allows it can reduce exposure, though it may not be possible on all ISP-managed gateways.