/
← Voltar ao feed
high telecommunications consumer_electronics

Unpatched 16-year-old Broadcom Wi-Fi WPS flaw enables unauthenticated RCE on routers, affecting 1.5M+ gateways in Belgium

1 fonte(s) · 1 atualização(ões) · publicado 18/10/2026 21:36 · coletado há 1 dia

Researcher Quentin Kaiser presented at Hexacon a vulnerability in Broadcom's proprietary 802.11 implementation, present in its SDK since at least 2010, that gives an attacker within Wi-Fi range unauthenticated remote code execution on affected routers without the network key or WPS enrollment. An incomplete patch was silently released in 2018, after which Broadcom recommended migrating to hostapd, making this a definitive "forever day" on eCos-based platforms and a potential one on Linux-based platforms. Kaiser demonstrated working exploits against the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. As of October 15, 2026, none of the affected devices in Belgium had been patched. Kaiser estimates over 1.5 million potentially exposed gateways in Belgium alone, and the chipsets are used by many vendors worldwide.

Technical Details

  • The flaw resides in the WPS EAP reassembly code and can be triggered over Wi-Fi without the network key or completing WPS enrollment. It yields controlled information disclosure and arbitrary code execution.
  • Affected eCos-based chipsets: BCM3380, BCM3383, BCM33834. Linux-based chipsets potentially affected: BCM3390, BCM65xx, BCM68xx.
  • In the demonstrations, the Wi-Fi PSK was extracted from router NVRAM and sent back over Wi-Fi, then used to join the network. A reverse shell was also opened using only Wi-Fi frames, with no internet-accessible C2.
  • The attack works at longer distances than shown in the lab videos. Risk is highest in targeted scenarios such as hotel networks or surveillance of nearby targets.
  • Kaiser reported the issue in July 2026. Broadcom claimed a patch existed, refused to assign a CVE, and CERT/CC closed its case the same day. No CVE exists.
  • Estimated Belgian exposure: ~850,000 Proximus, ~500,000 VOO legacy, ~210,000 Orange Belgium devices. Telenet may be affected via Sagemcom devices (unconfirmed).
  • Kaiser says AI-assisted analysis let him find the bugs in under a week.

Remediation

  • Kaiser is publishing a fingerprinting script and a YARA rule to help identify affected deployments.
  • Fixes depend on OEMs and ISPs migrating to hostapd or shipping patched firmware. eCos-based devices are effectively unfixable by design.
  • Defenders should inventory ISP-provided routers using the affected chipsets and engage ISPs/OEMs on firmware updates; no vendor patch is confirmed.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 18/10/2026 21:36 · coletado 19/10 17:54 primeiro registro

    Unpatched 16-year-old Broadcom Wi-Fi WPS flaw enables unauthenticated RCE on routers, affecting 1.5M+ gateways in Belgium

    ler a análise desta fonte

    Researcher Quentin Kaiser presented at Hexacon a vulnerability in Broadcom's proprietary 802.11 implementation, present in its SDK since at least 2010, that gives an attacker within Wi-Fi range unauthenticated remote code execution on affected routers without the network key or WPS enrollment. An incomplete patch was silently released in 2018, after which Broadcom recommended migrating to hostapd, making this a definitive "forever day" on eCos-based platforms and a potential one on Linux-based platforms. Kaiser demonstrated working exploits against the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. As of October 15, 2026, none of the affected devices in Belgium had been patched. Kaiser estimates over 1.5 million potentially exposed gateways in Belgium alone, and the chipsets are used by many vendors worldwide.

    Technical Details

    • The flaw resides in the WPS EAP reassembly code and can be triggered over Wi-Fi without the network key or completing WPS enrollment. It yields controlled information disclosure and arbitrary code execution.
    • Affected eCos-based chipsets: BCM3380, BCM3383, BCM33834. Linux-based chipsets potentially affected: BCM3390, BCM65xx, BCM68xx.
    • In the demonstrations, the Wi-Fi PSK was extracted from router NVRAM and sent back over Wi-Fi, then used to join the network. A reverse shell was also opened using only Wi-Fi frames, with no internet-accessible C2.
    • The attack works at longer distances than shown in the lab videos. Risk is highest in targeted scenarios such as hotel networks or surveillance of nearby targets.
    • Kaiser reported the issue in July 2026. Broadcom claimed a patch existed, refused to assign a CVE, and CERT/CC closed its case the same day. No CVE exists.
    • Estimated Belgian exposure: ~850,000 Proximus, ~500,000 VOO legacy, ~210,000 Orange Belgium devices. Telenet may be affected via Sagemcom devices (unconfirmed).
    • Kaiser says AI-assisted analysis let him find the bugs in under a week.

    Remediation

    • Kaiser is publishing a fingerprinting script and a YARA rule to help identify affected deployments.
    • Fixes depend on OEMs and ISPs migrating to hostapd or shipping patched firmware. eCos-based devices are effectively unfixable by design.
    • Defenders should inventory ISP-provided routers using the affected chipsets and engage ISPs/OEMs on firmware updates; no vendor patch is confirmed.