Threat Intelligence

Unpatched Broadcom Wi-Fi Flaw Could Let Nearby Attackers Take Over Routers

The Hacker News · 19 Oct 2026

Key Takeaway Check with your router or access point vendor whether your model uses Broadcom Wi-Fi, turn off WPS if the device allows it, and plan to replace any hardware the vendor confirms will not be patched.

Security researcher Quentin Kaiser disclosed on October 16 a flaw in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets devices join a network without typing the password. The code mishandles fragmented setup messages, so an attacker within radio range can corrupt the router's memory and run code as root, without the network password or any pairing step. No CVE has been assigned and, Kaiser says, no fix has been deployed to the affected routers. He reports no real-world attacks, and the working exploits are his own.

Kaiser demonstrated the attack on home gateways from three Belgian providers. On an Orange Belgium Askey TCG3000, he read the Wi-Fi password from the router's stored settings and joined the network. On a Proximus Sagemcom BBOX3V+, he opened a remote command line carried over Wi-Fi frames. Both ran without any login, and the attack works at a distance, not only up close.

Broadcom's code is embedded in devices from dozens of vendors, and Kaiser estimates millions are affected. Older eCos-based chips (BCM3380, BCM3383 and BCM33834) have no usable fix, which he calls a permanent "forever day". Newer Linux-based chips (BCM3390, BCM65xx and BCM68xx) could be fixed if makers switch Wi-Fi software. A wider list of devices he published mixes confirmed and unconfirmed entries, and some are only flagged as "likely vulnerable".

Broadcom Wi-Fi Router Security WPS Unpatched Vulnerability

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.