Key points
- The flaw has existed in Broadcom’s SDK since at least 2010 and affects WPS reassembly logic.
- Attackers can execute code or steal credentials from within Wi-Fi range without authentication.
- No patches have been confirmed for affected eCos-based chips, creating a permanent risk for those models.
Security researcher Quentin Kaiser demonstrated that attackers can take full control of vulnerable routers simply by being within wireless range. This capability bypasses standard security measures, including Wi-Fi passwords and WPS setup procedures. The exploit grants unauthenticated remote code execution, allowing malicious actors to read sensitive data or install backdoors on the device.
In plain English
The vulnerability resides in how Broadcom’s software handles Wi-Fi Protected Setup messages. When these messages are fragmented, the code fails to check lengths correctly. This oversight allows an attacker to send crafted wireless frames that corrupt the router’s memory. Once memory is corrupted, the attacker can redirect the device’s operations to run their own instructions or extract stored information, such as network passwords.
The background
Kaiser presented his findings at Hexacon in Paris on 16 October 2026. He confirmed the bug has been present in Broadcom’s proprietary 802.11 implementation since at least 2010. Although an incomplete patch was released in 2018, Broadcom later recommended migrating to hostapd software. This advice leaves older eCos-based platforms permanently vulnerable, while newer Linux-based models remain at risk unless manufacturers switch their software stacks.
What changes now
Kaiser successfully exploited gateways from three major Belgian internet providers: Proximus, Orange Belgium, and VOO. He extracted Wi-Fi passwords from an Orange ASKEY TCG3000 router and opened a reverse shell on a Proximus Sagemcom device. Estimates suggest approximately 1.56 million gateways in Belgium are affected. Millions more devices worldwide may be vulnerable, though exact global counts remain unknown.
The attacker's path
Teams usually monitor for unusual wireless traffic patterns that do not correspond to legitimate user activity. Check whether your infrastructure relies on legacy WPS implementations that have not been updated. This stage of an intrusion serves as an initial foothold, bypassing authentication entirely. Focus on detecting memory corruption indicators or unexpected code execution on network edge devices. Ensure that security policies account for physical proximity threats, as attackers need only be within radio range to initiate this type of compromise.
What to do and how to stay safe: Broadcom
- Disable Wi-Fi Protected Setup (WPS) on all managed routers to eliminate this specific attack vector.
- Audit client devices to identify those using Broadcom chips known to be affected by this legacy flaw.
- Monitor network logs for anomalous wireless frame patterns that suggest unauthenticated exploitation attempts.
- Plan for hardware replacement or software migration to hostapd for devices running eCos-based firmware.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch available for this Broadcom Wi-Fi flaw?
No fix has been confirmed for eCos-based chips, and Linux-based devices require a software migration to hostapd.
Which devices are confirmed to be vulnerable?
Kaiser demonstrated exploits on Orange Belgium ASKEY TCG3000 and Proximus Sagemcom F@st/BBOX3V+ routers.
Does the attacker need to know the Wi-Fi password?
No, the flaw allows unauthenticated remote code execution without knowing the network key or completing WPS setup.
