# 16-Year-Old Broadcom Wi-Fi Bug Enables Unauthenticated Router Takeover A long-standing SDK vulnerability exposes millions of routers to remote code execution attacks. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/2308b77a-8ed4-4671-ab4e-eb1d8d009f4f ## Persistent SDK Vulnerability A critical vulnerability in Broadcom’s proprietary 802.11 implementation has persisted since 2010. Researcher Quentin Kaiser identified that the flaw allows unauthenticated remote code execution on routers. This bug bypasses standard Wi-Fi passwords and WPS setup processes, creating a significant security risk for consumer hardware that remains unpatched across multiple global markets. ## Technical Exploitation Mechanism The exploit targets the WPS EAP reassembly code within the Broadcom SDK. Attackers within Wi-Fi range can trigger the flaw to extract sensitive data, such as the PSK from NVRAM, or execute arbitrary code. Demonstrations confirmed the ability to open a reverse shell using only wireless frames without internet-accessible command servers. ## Failed Remediation Efforts Broadcom released an incomplete fix in 2018 and subsequently advised manufacturers to migrate to hostapd instead of patching the proprietary code. This decision effectively rendered the bug a permanent, unfixable issue for eCos-based platforms like BCM3380 and BCM3383. Linux-based platforms remain equally vulnerable unless OEMs independently choose to migrate their software stacks. ## Demonstrated Real-World Attacks Kaiser successfully exploited the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+ routers. These tests proved that the vulnerability is not theoretical, as the researcher extracted Wi-Fi passwords and established reverse shells. The attack distance is not limited to the close-range laboratory setups shown in the initial video demonstrations. ## Scale of Potential Exposure Estimates based on Belgian telecom data suggest over 1.5 million gateways are potentially exposed. This includes approximately 850,000 Proximus devices, 500,000 VOO legacy units, and 210,000 Orange Belgium routers. Because these chipsets are integrated into hundreds of products worldwide, the total number of vulnerable devices across global markets is likely significantly higher. ## Disclosure Process Breakdown Kaiser reported the findings to Broadcom in July 2026, but the company refused to assign a CVE or share notifications. Broadcom directed the researcher to contact device manufacturers directly. CERT/CC opened and immediately closed a case, noting that Broadcom maintains the authority to assign CVEs but currently has no intention of doing so. ## AI-Accelerated Vulnerability Research Kaiser utilized AI-assisted analysis to identify these bugs in less than one week, a task that would have historically required months of manual effort. While this efficiency aids defenders in auditing deep infrastructure layers, it also lowers the barrier for attackers to discover and weaponize similar legacy vulnerabilities in proprietary software stacks. ## Strategic Security Implications The existence of a 16-year-old bug highlights the dangers of relying on proprietary, unmaintained SDKs in critical network infrastructure. With no centralized patch mechanism, security teams and users remain largely unprotected. Mapping the full scope of affected deployments now requires specialized fingerprinting scripts and YARA rules to identify vulnerable hardware in production. ## Sources covering this story - https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._