# Broadcom Wi-Fi Vulnerability Exposes Millions of Routers to Hijacking A sixteen-year-old flaw in Broadcom chips allows unauthorized access without network passwords. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/31b89f94-b9da-49ed-943a-3e097bb2610c ## The WPSplinter Security Flaw Security researcher Quentin Kaiser identified a critical vulnerability, dubbed WPSplinter, affecting Broadcom Wi-Fi software. This flaw, dating back to 2010, allows attackers to hijack routers without needing a network password. By exploiting memory corruption in the Wi-Fi Protected Setup feature, unauthorized parties can execute arbitrary code directly on the target hardware devices. ## Scope of Affected Hardware The vulnerability impacts millions of routers, with approximately 1.56 million devices identified in Belgium alone. Affected units include gateways from Proximus, Orange, and VOO, utilizing specific Broadcom chips like the BCM3380 and BCM3383. Because Broadcom technology is ubiquitous, the global scale of potentially compromised routers remains significantly higher than current regional estimates. ## Historical Context and Failures Broadcom reportedly knew about the vulnerability since 2018 but failed to implement a comprehensive fix. While the company released a partial patch, it did not publicly disclose the issue at the time. Broadcom eventually advised manufacturers to transition away from their proprietary implementation toward the open-source hostapd software to mitigate these recurring security risks. ## The Forever Day Problem Devices running older eCos-based chips face a grim outlook, as Kaiser describes the flaw as a forever day. These routers may never receive a functional patch, leaving them permanently exposed. Even newer Linux-based chips remain vulnerable unless manufacturers proactively switch to the recommended hostapd software, which many older, unsupported models will not receive. ## Disclosure and Coordination Hurdles Kaiser reported the findings to Broadcom in July, providing a 90-day window before public disclosure. Broadcom declined to assign a CVE identifier or share notification details sent to vendors. Furthermore, CERT/CC closed the case because Broadcom, acting as a CVE Numbering Authority, refused to register the vulnerability, stalling the industry-wide patching process. ## Exploitation and Potential Impact Attackers within Wi-Fi range can compromise routers to steal network credentials or intercept traffic. In demonstrations, Kaiser successfully extracted Wi-Fi passwords from memory on ASKEY TCG3000 gateways. While no attacks in the wild are currently confirmed, the ability to gain full control without user interaction presents a severe security risk. ## AI-Accelerated Security Research Kaiser utilized frontier AI models to significantly expedite his investigation into the Broadcom firmware. He estimates that the complex analysis, which would have traditionally required months of manual effort, was completed in less than one week. This highlights how advanced tools are increasingly enabling researchers to uncover long-standing, deep-seated vulnerabilities. ## Current Patching Status As of October 15, one day before the public presentation, none of the identified vulnerable devices had received a security patch. The lack of coordination between the chipmaker and internet service providers leaves millions of users exposed. Without manufacturer intervention, these routers remain susceptible to unauthorized access and potential network-level interference. ## Sources covering this story - https://www.theregister.com/networks/2026/10/19/broadcom-wi-fi-bug-turns-sweet-16-still-lets-strangers-hijack-your-router/5303771 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._