Full Report
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
Analysis Summary
# Vulnerability: Broadcom WPS Fragmentation Flaw Enables Unauthenticated Root Code Execution on Routers
## CVE Details
- CVE ID: Not assigned. As of October 19, 2026, no CVE had been issued. Broadcom reportedly declined to assign one, and CERT/CC closed its case the same day because Broadcom holds CVE authority for its products.
- CVSS Score: Not available (no CVE or vendor scoring published)
- CWE: Not specified in the article. The described behavior, mishandling of fragmented message reassembly that corrupts memory, suggests a memory-corruption weakness, but no CWE has been assigned.
## Affected Systems
- Products: Routers and access points from multiple vendors that use Broadcom's WPS implementation. Kaiser estimates millions of devices are affected. Confirmed examples include:
- Orange Belgium gateway (Askey TCG3000)
- Proximus gateway (Sagemcom-built BBOX3V+)
- Gateways from VOO (confirmed exploitable)
- Telenet gateways (possibly affected, untested)
- A wider list in the researcher's publication includes Cisco small-business APs, Huawei, and ARRIS devices. Some entries are unconfirmed and based on an automated "likely vulnerable" check.
- Versions: No specific firmware versions were given in the article. Affected chip families:
- **eCos-based:** BCM3380, BCM3383, BCM33834 (no usable fix found)
- **Linux-based:** BCM3390, BCM65xx, BCM68xx (fixable if vendors change their Wi-Fi software)
- Configurations: The attack requires only proximity over Wi-Fi. No network password, pairing, or login is needed. The flaw is in Broadcom's WPS code, so devices with WPS functionality are the relevant surface.
## Vulnerability Description
Broadcom's proprietary WPS implementation mishandles the reassembly of fragmented WPS setup messages. An attacker within radio range can send crafted messages that corrupt router memory. The researcher built two capabilities from this:
1. **Memory read:** Used against an Orange Belgium gateway to extract the stored Wi-Fi PSK, which was sent back over the air.
2. **Code execution:** Used against a Proximus gateway to open a reverse shell tunneled over Wi-Fi frames, requiring no external server.
Kaiser traces the code to at least 2010. Broadcom shipped an incomplete fix in 2018 and advised customers to move to hostapd. On eCos chips, no working fix was shipped, so the researcher calls it a "forever day."
## Exploitation
- Status: PoC available. The researcher has working exploits, though the article does not say whether they are publicly released. He reports no real-world exploitation.
- Complexity: Not explicitly stated. The article notes the attack works at a distance and requires no authentication or pairing.
- Attack Vector: Adjacent (wireless, within radio range)
## Impact
- Confidentiality: High. The Wi-Fi PSK can be read from device memory.
- Integrity: High. Code runs as root on the device.
- Availability: Likely affected, since memory corruption is involved. The article does not detail denial-of-service impact.
## Remediation
### Patches
- No patch is available for the affected devices as of the reporting date.
- eCos-based models (BCM3380, BCM3383, BCM33834): No fix exists. The researcher considers them permanently vulnerable.
- Linux-based models (BCM3390, BCM65xx, BCM68xx): Could be fixed if device makers replace Broadcom's WPS software, for example by moving to hostapd. This depends on vendor action.
### Workarounds
- The article identifies no setting that blocks the over-the-air attack.
- Replacing affected devices is the practical option for hardware that will never be fixed.
- Contact the ISP or device vendor to request a fix or replacement. Also check whether WPS can be disabled on the device. This is general hardening, not a verified mitigation for this flaw.
- Limit exposure in sensitive environments, since the attack works from outside the building (for example, from across a street).
## Detection
- Indicators of compromise: The article does not describe host-level IoCs. Unexplained Wi-Fi activity involving WPS setup messages or unexpected devices joining the network could warrant review.
- Detection tools:
- YARA rules published by the researcher to identify the vulnerable code in extracted firmware
- A script that listens to a live access point and reports whether it looks vulnerable
Both are triage aids. A patched device may still match the YARA rules, so a match is a reason for further investigation, not confirmation.
## References
- Researcher disclosure: hxxps://quentinkaiser[.]be/security/2026/10/16/one-parser-two-bugs/
- YARA rules and scanning script: hxxps://github[.]com/qkaiser/broadcom-wps
- The Hacker News article: hxxps://thehackernews[.]com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html
- Related context, Volexity on nearest-neighbor Wi-Fi attacks by Russian APT: hxxps://www[.]volexity[.]com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
- Broadcom vendor advisory: None found in the article.