# Critical Broadcom Wi-Fi Flaw Enables Remote Root Access on Routers Unpatched vulnerability in Broadcom WPS software allows attackers to execute code without authentication. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/8ba82aaf-4505-411c-9cd3-ee2dc7350a10 ## Unpatched Broadcom Security Flaw Security researcher Quentin Kaiser disclosed a critical vulnerability in Broadcom's Wi-Fi Protected Setup software on October 16. The flaw allows attackers within radio range to execute code as root on routers without requiring passwords or pairing. No CVE identifier has been assigned to this issue, and currently, no official security patches exist. ## Exploitation Mechanism Explained The vulnerability stems from how Broadcom's code reassembles fragmented WPS setup messages. Attackers can send specifically crafted messages to corrupt the router's memory, enabling them to read stored settings or run arbitrary code. Kaiser successfully demonstrated this by reading Wi-Fi passwords and opening remote shells on Belgian ISP-provided gateways like Askey and Sagemcom. ## Scope of Affected Hardware Millions of devices worldwide are potentially vulnerable, ranging from home gateways to small business access points. The affected chips include older eCos-based models like the BCM3380 and newer Linux-based variants such as the BCM68xx. Kaiser identified gateways from Proximus, Orange Belgium, and VOO as confirmed targets during his research and testing phase. ## The Forever Day Problem Kaiser classifies the flaw as a forever day for older eCos-based chips, meaning these devices will never receive a functional patch. While newer Linux-based models could theoretically be secured if manufacturers switch to hostapd software, the lack of a CVE has hindered coordinated disclosure and left many device makers unaware of the risk. ## Historical Context of Vulnerability The problematic code dates back to at least 2010. Broadcom reportedly issued an incomplete fix in 2018 but advised customers to migrate to different software packages instead of relying on the patch. Because Broadcom holds the authority to assign CVEs for its products, the CERT Coordination Center closed the case without further action. ## Detection and Triage Tools Since no official patches are available, Kaiser released YARA rules and a script to help identify vulnerable firmware and live access points. These tools serve as triage aids rather than definitive proof of exploitability. A positive match indicates a need for further investigation, but users cannot simply install a software update to fix it. ## Risk Mitigation Strategies For devices that will never receive a manufacturer patch, replacement remains the only practical security option. The attack is particularly dangerous because it functions over the air without requiring internet access, mirroring techniques previously used by state-sponsored actors to breach networks from nearby locations. Users should prioritize replacing hardware that remains permanently vulnerable. ## Implications for Network Security This discovery highlights the persistent danger of unpatched legacy code embedded in millions of consumer routers. The absence of a CVE identifier significantly complicates vulnerability management for ISPs and end users. Organizations must now evaluate their hardware inventory against these specific Broadcom chipsets to assess their exposure to potential local network attacks. ## Sources covering this story - https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._