Critical Broadcom Wi-Fi Flaw Enables Remote Root Access on Routers
Unpatched vulnerability in Broadcom WPS software allows attackers to execute code without authentication.
1Unpatched Broadcom Security Flaw
Security researcher Quentin Kaiser disclosed a critical vulnerability in Broadcom's Wi-Fi Protected Setup software on October 16. The flaw allows attackers within radio range to execute code as root on routers without requiring passwords or pairing. No CVE identifier has been assigned to this issue, and currently, no official security patches exist.
2Exploitation Mechanism Explained
The vulnerability stems from how Broadcom's code reassembles fragmented WPS setup messages. Attackers can send specifically crafted messages to corrupt the router's memory, enabling them to read stored settings or run arbitrary code. Kaiser successfully demonstrated this by reading Wi-Fi passwords and opening remote shells on Belgian ISP-provided gateways like Askey and Sagemcom.
3Scope of Affected Hardware
Millions of devices worldwide are potentially vulnerable, ranging from home gateways to small business access points. The affected chips include older eCos-based models like the BCM3380 and newer Linux-based variants such as the BCM68xx. Kaiser identified gateways from Proximus, Orange Belgium, and VOO as confirmed targets during his research and testing phase.
4The Forever Day Problem
Kaiser classifies the flaw as a forever day for older eCos-based chips, meaning these devices will never receive a functional patch. While newer Linux-based models could theoretically be secured if manufacturers switch to hostapd software, the lack of a CVE has hindered coordinated disclosure and left many device makers unaware of the risk.
5Historical Context of Vulnerability
The problematic code dates back to at least 2010. Broadcom reportedly issued an incomplete fix in 2018 but advised customers to migrate to different software packages instead of relying on the patch. Because Broadcom holds the authority to assign CVEs for its products, the CERT Coordination Center closed the case without further action.
6Detection and Triage Tools
Since no official patches are available, Kaiser released YARA rules and a script to help identify vulnerable firmware and live access points. These tools serve as triage aids rather than definitive proof of exploitability. A positive match indicates a need for further investigation, but users cannot simply install a software update to fix it.
7Risk Mitigation Strategies
For devices that will never receive a manufacturer patch, replacement remains the only practical security option. The attack is particularly dangerous because it functions over the air without requiring internet access, mirroring techniques previously used by state-sponsored actors to breach networks from nearby locations. Users should prioritize replacing hardware that remains permanently vulnerable.
8Implications for Network Security
This discovery highlights the persistent danger of unpatched legacy code embedded in millions of consumer routers. The absence of a CVE identifier significantly complicates vulnerability management for ISPs and end users. Organizations must now evaluate their hardware inventory against these specific Broadcom chipsets to assess their exposure to potential local network attacks.