A Belgian researcher has shown that a flaw in Broadcom’s Wi-Fi software, present since at least 2010, lets anyone within radio range take over affected routers without knowing the Wi-Fi password. Broadcom has refused to assign a CVE, so most scanners are unlikely to flag it.
What happened
On 16 October 2026, security researcher Quentin Kaiser presented research at the Hexacon conference in Paris showing that Broadcom’s proprietary 802.11 software stack contains a memory corruption bug in the code that handles Wi-Fi Protected Setup (WPS). He published a detailed write-up the same day with detection tools and a public list of affected hardware.
Kaiser says the flaw is exploitable on gateways from three of Belgium’s four main internet providers, Proximus, VOO and Orange, and his videos show unauthenticated remote code execution on two of them: the ASKEY TCG3000 supplied by Orange Belgium and the Sagemcom-built BBOX3V+ supplied by Proximus. In one demonstration, code running on the router read the Wi-Fi key out of its configuration memory and sent it back to the attacker over the air. In the other, he obtained a remote shell carried entirely over Wi-Fi frames, with no internet-facing command server involved.
The disclosure story is as important as the bug. Kaiser reported the eCos variant to Broadcom on 18 July and the Linux variant on 27 July. According to his timeline, Broadcom replied that a patch already existed and that device makers should contact it directly, then declined to register a CVE or share the notice it had sent to manufacturers. A case opened with CERT/CC on 4 August was closed the same day, because Broadcom is itself a CVE Numbering Authority and would not issue an identifier. Kaiser says that, as of 15 October, none of the affected Belgian ISP devices he identified had been patched.
The technical picture
The flaw sits in the routine that reassembles WPS messages that arrive split across several fragments. According to Kaiser, an attacker can trigger it without knowing the network key and without completing a normal WPS enrolment, which means the vulnerable code runs before any meaningful authentication takes place. Exploitation gives both a controlled information leak and arbitrary code execution on the device.
Two platform families are affected. On eCos-based chipsets (BCM3380, BCM3383 and BCM33834), Kaiser describes the bug as a “definitive forever day”, because Broadcom’s advice was to migrate away from its own implementation to the open source hostapd rather than fix the legacy code. On Linux-based chipsets (BCM3390, BCM65xx and BCM68xx), whether devices get fixed depends on each manufacturer acting. Broadcom told Kaiser it had known of the issue since 2018, when an incomplete fix was quietly released.
Kaiser’s public list now runs well beyond Belgium. It includes Cisco RV and WAP small business routers and access points, Huawei B310, B315 and B593 mobile broadband routers, Netgear cable gateways, several TP-Link Archer models, ZTE and Nokia fibre gateways and an ARRIS SURFboard unit. French outlet Clubic reported that Kaiser’s passive survey in Paris classed the Sagemcom version of Orange’s Livebox 5 and SFR’s NB6VAC box as unpatched, while the Livebox 6 and Bouygues Telecom’s latest Bbox were listed as fixed. Kaiser stresses the list is not exhaustive and expects it to reach thousands of models.
Why it matters for UK organisations
No UK internet provider appears in the published list or in any of the coverage so far. But the researcher is clear that the affected manufacturers serve a larger market than Belgium, and several of the brands and product lines named are sold through ordinary UK distribution channels and turn up routinely in small offices, branch sites and remote workers’ homes.
The missing CVE is the real problem for UK defenders. Vulnerability management in most organisations is driven by CVE identifiers. A flaw with no identifier will not appear in scanner plug-ins, threat intelligence feeds, CISA’s catalogue or supplier security bulletins that key off CVEs.
The attack also has an unusual shape. It needs physical proximity rather than internet access, which tempts people to dismiss it. Kaiser warns the opposite: he says the attack “works over long distances”, and he highlights nearest-neighbour attacks and hotel network compromise as natural uses. For a UK organisation, that maps onto shared office buildings, retail units, serviced offices and staff working from flats, where a compromised router quietly gives an attacker a position on the local network and the ability to watch or alter traffic.
Expert view
In my experience, routers and access points are the least examined devices on almost every network we test. They are rarely in the asset register, almost never in the patching schedule, and frequently belong to the ISP rather than the organisation. This research lands squarely in that blind spot.
The disclosure handling deserves criticism. A chip vendor aware of the bug since 2018, declining a CVE and pointing researchers at its customers creates exactly the conditions Kaiser describes: a 16-year bug lifespan and a supply chain where nobody owns the outcome. The CVE system relies on CNAs acting in good faith, and when the vendor and the CNA are the same organisation, there is no independent backstop.
I would not treat this as a reason to panic about every Wi-Fi network in the country. Exploitation requires an attacker within radio range and real skill, and there are no public reports of attacks in the wild. But detailed write-ups, slides and demonstration videos are now public, so the barrier will fall. When we test physical and wireless security, the hardest part is usually getting close enough; here, close enough could be a car park.
What to do now
- Inventory your wireless kit. List every router, gateway and access point, including ISP-supplied boxes. Compare make and model against Kaiser’s public list on GitHub. This supports the Cyber Essentials secure configuration and security update management controls.
- Turn off WPS everywhere it is not needed. Clubic notes this is not a guaranteed fix for this flaw, but there is rarely a business reason to leave WPS on, and disabling it reduces exposure.
- Do not rely on changing the Wi-Fi password. The vulnerable code runs before authentication, so a stronger key does not help here.
- Ask your ISP and suppliers directly. Request written confirmation of whether supplied gateways use the affected Broadcom code and when firmware will be updated.
- Replace unsupported devices. If a model is out of vendor support, it will not be fixed. Treat it as end of life under Cyber Essentials and plan replacement.
- Segment and monitor. Keep corporate devices off ISP-managed Wi-Fi where possible, use wired connections or enterprise-grade access points for sensitive areas, and ensure remote workers connect through a VPN or zero trust client so a compromised home router sees only encrypted traffic.
- Add a manual tracking entry. Without a CVE, your scanner will not chase this for you. Log it internally.
Bottom line
A 16-year-old, pre-authentication flaw in widely used Broadcom Wi-Fi code now has public research behind it and no CVE to track it. UK organisations should assume their scanners are blind to it, check their wireless estate by hand, disable WPS, press suppliers for firmware and retire hardware that will never be fixed.
Sources
- Quentin Kaiser: One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux
- GitHub (qkaiser): Broadcom 802.11 SDK Detection Toolkit and affected devices list
- Security Affairs: 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password
- Clubic: Faille Wi-Fi critique : des Livebox d’Orange et box SFR piratables sans mot de passe
