Broadcom WPS Flaw Exposes Millions of Routers to Unpatched Over-the-Air Takeover Attacks
Kiran 
A researcher known as qkaiser has disclosed a Broadcom WiFi parsing flaw that lets attackers run code on routers without the network key.
It has no CVE and is still unpatched on the Belgian ISP devices he tested. He presented the work at Hexacon in Paris on October 16, 2026, and published a public site called WPSplinter.
The flaw sits in Broadcom’s proprietary 802.11 implementation, in the WPS EAP reassembly code. Source code traced to at least 2010 contains the vulnerable logic. Broadcom quietly released an incomplete patch in 2018 and later advised vendors to move to hostapd.
Broadcom WPS Flaw Exposes Millions of Routers
That leaves eCos-based platforms (BCM3380, BCM3383, BCM33834) as a definitive “forever day”. Linux-based platforms (BCM3390, BCM65xx, BCM68xx) are a potential one, unless manufacturers agree to migrate.
An attacker can trigger the bug remotely over WiFi. They need neither the network key nor a completed WPS enrollment. The result is controlled information disclosure and arbitrary code execution.
In one demo against an Orange Belgium ASKEY TCG3000, shellcode pulled the pre-shared key from NVRAM and sent it back over 802.11.
The researcher then joined the network with the leaked key. In another demo against a Proximus BBOX3V+ (a Sagemcom F@st), he opened a reverse shell over WiFi frames, so no cloud command-and-control server was needed.
He demonstrated exploitation on three of four Belgian ISPs. As of October 15, none of the affected devices had been patched.
| ISP | Confirmed models | Estimated affected gateways |
|---|---|---|
| Proximus | BBOX 3, BBOX3V+ | 850,000 |
| VOO | Netgear CG3100, CG3700, Technicolor TC7210, CGA4233 | 500,000 |
| Orange Belgium | ASKEY TCG3000 | 210,000 |
| Telenet | F@ST3896LG, F@ST5685LGB (unconfirmed) | Unknown |
The figures come from his own estimates, built from regulator (IBPT) data and ISP statements. He rates his confidence in them as medium.
He says dozens of vendors and hundreds of products may be affected worldwide. To help map the exposure, he released a fingerprinting script and a YARA rule on GitHub.
He followed a 90-day policy, starting on July 18, 2026, when he reported the first bug to Broadcom’s PSIRT. A second report, covering the Linux-based chips, followed on July 27.
Broadcom replied that a patch existed and told him to ask manufacturers to contact the company. It refused to register a CVE or share its OEM notifications.
CERT/CC closed his VINCE case on August 4. Broadcom is a CVE Numbering Authority, and it would not issue a CVE. He also contacted Proximus, Orange Belgium, VOO, and the Cyber Security Center Belgium. Proximus engaged, but Orange Belgium never answered.
He says AI frontier models cut research time to under a week, work that would otherwise take months. That lowers the cost of digging into old embedded code. He also points to a 16-year bug lifespan and mismatched support windows between chipmaker, OEM, and ISP.
He warns that threat actors who favor nearest-neighbor attacks or hotel network compromises would find these bugs attractive.
Such attacks are targeted and happen over the air. Defenders have little visibility into affected devices, which lets attackers manipulate devices and collect traffic.
Until patches arrive, the practical advice is limited. Users should disable WPS if their router allows it and ask their ISP for firmware updates. The fingerprinting tools should help ISPs and defenders gauge their exposure.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
