Why this matters: a strong Wi-Fi password cannot protect a router whose setup code hands over control — and for many older gateways, no fix may ever arrive.
October 19, 2026 — A flaw in Broadcom Wi-Fi software lets an attacker within wireless range run code as root on vulnerable routers without knowing the network password, researcher Quentin Kaiser disclosed on October 16. The bug, present in Broadcom's SDK since at least 2010, affects its Wi-Fi Protected Setup (WPS) code. Kaiser says no CVE has been assigned and no fix had reached the Belgian gateways he tested as of October 15, 2026.
Image: A home router with glowing red wireless signals and a cracked padlock of light, watched from across the street. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: This is not a weak-password problem. The exploit corrupts router memory before any login, so the password itself becomes something an attacker can steal.
Table of Contents
- How the WPS Flaw Works
- Two Demonstrations: Password Theft and a Root Shell
- Which Chips and Routers Are Affected
- Why There Is No Patch and No CVE
- Belgium Shows the Scale, but the Risk Is Global
- What Router Owners Can Do Now
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Researcher | Quentin Kaiser |
| Disclosed | October 16, 2026, at Hexacon in Paris |
| Flaw location | Broadcom WPS EAP reassembly code |
| Present since | At least 2010, in Broadcom's SDK |
| Attack requirement | Within Wi-Fi range; no password or login |
| Belgium estimate | More than 1.5 million gateways, researcher estimate |
| CVE status | None assigned as of October 19 |
| Real-world attacks | None reported by Kaiser |
How the WPS Flaw Works
WPS lets a new device join a Wi-Fi network without typing the password. According to The Hacker News, Broadcom's code mishandles reassembly of fragmented WPS messages, so an attacker in range can send crafted messages that corrupt router memory — then read information back, or run their own code on it.
Tech Analysis: The attack happens before authentication. That is why a long, strong WPA2 or WPA3 password does not, on its own, close this particular door.
Two Demonstrations: Password Theft and a Root Shell
Kaiser showed working exploits against Belgian provider gateways. Against an Orange Belgium Askey TCG3000, the exploit read the Wi-Fi password — the PSK — from stored settings, sent it back over the air, and he then joined the network with it.
Against a Proximus Sagemcom-built BBOX3V+, it opened a reverse shell — a remote command line carried over Wi-Fi frames, with no outside server needed.
Newsroom Focus: Kaiser says both attacks ran without any login, and work at a distance — the close antenna in his lab videos was a test setup, not a requirement. He reports no real-world attacks; the working exploits are his own.
Which Chips and Routers Are Affected
Broadcom's WPS code sits in routers from dozens of vendors. Kaiser estimates millions of devices worldwide are affected, with no complete list yet. The chips fall into two families:
| Platform | Chipsets | Patch outlook |
|---|---|---|
| eCos-based | BCM3380, BCM3383, BCM33834 | No usable fix found; called a permanent forever day |
| Linux-based | BCM3390, BCM65xx, BCM68xx | Fixable if makers switch Wi-Fi software |
Kaiser found the flaw present and exploitable on gateways from three of the four big providers (Proximus, Orange Belgium, VOO). A fourth, Telenet, may be affected too, but he could not obtain a device to test.
His wider list ranges from Cisco access points to Huawei and ARRIS routers, but mixes confirmed and unconfirmed entries — inclusion alone is not proof for a specific model.
Why There Is No Patch and No CVE
Kaiser traces the code to at least 2010 and says Broadcom shipped an incomplete fix in 2018, then told customers to switch to other Wi-Fi software, hostapd, rather than relying on it. On older eCos chips, he says, no working fix was ever shipped.
He reported the bugs in July 2026. Broadcom, in his account, said a patch was available and told him to ask manufacturers to contact Broadcom directly.
| Date | Event |
|---|---|
| 2010 | Vulnerable code present in Broadcom SDK, at latest by this year |
| 2018 | Incomplete patch silently released, Kaiser says |
| July 18 and 27, 2026 | Kaiser reports the eCos and Linux flaws to Broadcom |
| October 15, 2026 | Tested Belgian devices still unpatched |
| October 16, 2026 | Public disclosure at Hexacon in Paris |
No CVE has been assigned. Kaiser says Broadcom would not register one, and his CERT Coordination Center case was closed the same day because Broadcom itself holds CVE authority for its products.
Belgium Shows the Scale, but the Risk Is Global
SecurityAffairs, summarising Kaiser's calculation, puts Belgian exposure at about 850,000+ Proximus gateways, 500,000+ in VOO's legacy fleet and 210,000+ for Orange Belgium — north of 1.5 million in one small country. Kaiser describes the numbers as rough estimates, not a census.
The affected manufacturers sell well beyond Belgium, so those figures are an indicator, not a worldwide count. Newsroom Focus: The risk is greatest in targeted attacks on a specific home, office or hotel network, where a compromised router can quietly expose traffic.
What Router Owners Can Do Now
There is no patch for the tested devices, and Kaiser points to no setting that blocks the attack over the air. Identification is the first step: his YARA rules and fingerprinting script are triage aids, not proof.
- Check your model against Kaiser's documentation and your provider's advisories.
- Ask your provider whether your model is affected and if a replacement is available.
- Apply any firmware update promptly when one is released.
- For gear that will never be fixed, replacement is the practical option.
- Keep a strong, unique Wi-Fi password anyway, against ordinary guessing.
Practical Takeaway: For an older provider-supplied gateway, ask the provider about its patch status directly — a password change alone does not remove this risk.
Bottom Line
A 16-year-old flaw in Broadcom's WPS code can give a nearby attacker root control without a password. Watch next whether providers and manufacturers name affected models — and offer replacements where no patch is possible.
FAQ
Does an attacker need my Wi-Fi password?
No. Kaiser says it can be triggered without the network key and without completing a normal WPS enrollment.
Does the attacker need to be inside my home?
No — only within Wi-Fi range, and Kaiser says it works at a distance.
Has this flaw been used in real attacks?
Kaiser reports no real-world attacks. The working exploits are his own research.
Why is there no CVE number?
Kaiser says Broadcom declined to register one. The Hacker News found none as of October 19, 2026.
Can I fix it by changing my password?
No. A password change does not patch the code, and no blocking setting is identified. Check for provider firmware and consider replacement for unpatchable models.
Sources
- The Hacker News — Broadcom Wi-Fi flaw report — http://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html
- SecurityAffairs — 16-year-old Broadcom Wi-Fi bug — https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html
- Quentin Kaiser — primary research, One Parser, Two Bugs, Many Routers — https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
- ThaiCERT — Broadcom Wi-Fi chipset vulnerability — https://www.thaicert.or.th/en/2026/10/19/broadcom-wi-fi-chipset-vulnerability-could-allow-router-takeover-without-a-password
- Hero image — AI-generated illustration / Red Eye Eagle News, original illustration.
Join the conversation
Comments
Post a Comment