/
← Voltar ao feed
high telecommunications

Unpatched Broadcom WPS flaw lets in-range attackers run code as root on millions of Wi-Fi routers; no CVE or fix

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 03:29 · coletado há 4 dias

Researcher Quentin Kaiser disclosed on October 16 an unauthenticated memory-corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It lets an attacker within radio range execute code as root on affected routers, with no Wi-Fi password or pairing step. Kaiser demonstrated working exploits against Belgian ISP gateways: the Askey TCG3000 (Orange Belgium), where he read the PSK and joined the network, and the Sagemcom BBOX3V+ (Proximus), where he opened a reverse shell over Wi-Fi frames. No CVE has been assigned and no fix has been deployed. Kaiser estimates millions of devices are affected worldwide and reports no real-world exploitation.

Detalhes técnicos

  • Broadcom's WPS code mishandles reassembly of fragmented WPS setup messages. Crafted messages corrupt router memory, which Kaiser turned into a memory read primitive and a code execution primitive.
  • The code dates to at least 2010. Broadcom shipped an incomplete fix in 2018 and told customers to switch to hostapd. Older eCos-based chips (BCM3380, BCM3383, BCM33834) have no usable fix, making this a "forever day". Newer Linux-based chips (BCM3390, BCM65xx, BCM68xx) could be fixed if vendors change Wi-Fi software.
  • In Belgium, gateways from Proximus, Orange Belgium and VOO were confirmed vulnerable. Telenet may be affected but was untested. Per-provider counts run into the hundreds of thousands, but these are rough estimates.
  • The wider affected-device list (Cisco small-business access points, Huawei, ARRIS and others) mixes confirmed and unconfirmed entries; some rely on an automated check that only flags a device as "likely vulnerable".
  • Broadcom said it has known of the bug since 2018 but would not register a CVE. CERT/CC closed the case the same day because Broadcom holds CVE assignment authority for its products. The Hacker News found no CVE as of October 19.
  • The attack suits adversaries who reach targets over nearby Wi-Fi rather than the internet, a technique Russian state hackers have used to breach networks from across the street.

Remediação

  • No patch is available and no over-the-air mitigation has been identified.
  • Kaiser provides YARA rules to detect the vulnerable code in extracted firmware and a script that listens to a live access point and reports whether it looks vulnerable. Both are triage aids only: a patched device can still match, so a hit warrants further verification.
  • For devices that will never be fixed (eCos-based chips), replacement is the practical option.

Linha do tempo

  1. thehackernews.com ↗ · pub. 19/10/2026 03:29 · coletado 19/10 17:53 primeiro registro

    Unpatched Broadcom WPS flaw lets in-range attackers run code as root on millions of Wi-Fi routers; no CVE or fix

    ler a análise desta fonte

    Researcher Quentin Kaiser disclosed on October 16 an unauthenticated memory-corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It lets an attacker within radio range execute code as root on affected routers, with no Wi-Fi password or pairing step. Kaiser demonstrated working exploits against Belgian ISP gateways: the Askey TCG3000 (Orange Belgium), where he read the PSK and joined the network, and the Sagemcom BBOX3V+ (Proximus), where he opened a reverse shell over Wi-Fi frames. No CVE has been assigned and no fix has been deployed. Kaiser estimates millions of devices are affected worldwide and reports no real-world exploitation.

    Technical Details

    • Broadcom's WPS code mishandles reassembly of fragmented WPS setup messages. Crafted messages corrupt router memory, which Kaiser turned into a memory read primitive and a code execution primitive.
    • The code dates to at least 2010. Broadcom shipped an incomplete fix in 2018 and told customers to switch to hostapd. Older eCos-based chips (BCM3380, BCM3383, BCM33834) have no usable fix, making this a "forever day". Newer Linux-based chips (BCM3390, BCM65xx, BCM68xx) could be fixed if vendors change Wi-Fi software.
    • In Belgium, gateways from Proximus, Orange Belgium and VOO were confirmed vulnerable. Telenet may be affected but was untested. Per-provider counts run into the hundreds of thousands, but these are rough estimates.
    • The wider affected-device list (Cisco small-business access points, Huawei, ARRIS and others) mixes confirmed and unconfirmed entries; some rely on an automated check that only flags a device as "likely vulnerable".
    • Broadcom said it has known of the bug since 2018 but would not register a CVE. CERT/CC closed the case the same day because Broadcom holds CVE assignment authority for its products. The Hacker News found no CVE as of October 19.
    • The attack suits adversaries who reach targets over nearby Wi-Fi rather than the internet, a technique Russian state hackers have used to breach networks from across the street.

    Remediation

    • No patch is available and no over-the-air mitigation has been identified.
    • Kaiser provides YARA rules to detect the vulnerable code in extracted firmware and a script that listens to a live access point and reports whether it looks vulnerable. Both are triage aids only: a patched device can still match, so a hit warrants further verification.
    • For devices that will never be fixed (eCos-based chips), replacement is the practical option.