A flaw in Broadcom’s Wi-Fi software lets someone within wireless range take over a home router without knowing its password. The code behind this Broadcom router vulnerability has shipped since at least 2010, Broadcom has known about the problem since 2018, and there is still no CVE number for it. That last detail explains a lot about why it has lasted 16 years.
Belgian security researcher Quentin Kaiser presented the findings at the Hexacon conference in Paris on October 16 and published a detailed write-up the same day. He calls the issue “WPSplinter.”
What the bug is
The problem sits in Broadcom’s own implementation of Wi-Fi Protected Setup (WPS), the push-button feature that lets a printer or TV join a network without typing a password. During setup, devices exchange messages that can arrive in pieces. Broadcom’s code reassembles those pieces without checking their size properly, so a specially crafted message can overwrite the router’s memory.
According to Kaiser, an attacker can reach that code over the air before any WPS pairing is complete and without the Wi-Fi key. On affected devices he demonstrated two things: reading data out of the router’s memory and running his own code on it. On an Orange Belgium ASKEY TCG3000 gateway, he pulled out the saved Wi-Fi password and used it to join the network. Kaiser writes that the attack is not limited to someone standing next to the router: “Don’t be fooled by the antenna proximity. This attack works over long distances.”
Kaiser says he has seen no evidence of attacks in the wild. Some reports have suggested otherwise, but none we found points to a confirmed case.
Which routers are affected
The vulnerable component, called WPS Monitor, is part of the software kit Broadcom gives to router makers. Kaiser’s write-up names two groups of chips:
- Older eCos-based chips (BCM3380, BCM3383, BCM33834). eCos is a small embedded operating system. Broadcom’s fix is to replace WPS Monitor with hostapd, the open-source Wi-Fi software used on Linux, and these chips cannot run it. Kaiser expects them to stay vulnerable for good.
- Newer Linux-based chips (BCM3390, BCM63xx, BCM65xx, BCM68xx). These can be fixed, but only if the router maker has actually moved to hostapd and shipped the update.
In Belgium, where Kaiser did his testing, he confirmed affected gateways at Proximus, VOO and Orange Belgium, and roughly estimates about 1.56 million exposed devices across the three. His public device list goes much wider, with models from ARRIS, ASUS, Cisco, D-Link, Netgear, Sagemcom, TP-Link, ZTE, Zyxel and others, often tied to specific internet providers. He stresses that the list is not exhaustive and that results depend on the exact hardware and firmware.
How a known bug avoided a CVE
A CVE is the standard ID number given to a publicly known security flaw. Vulnerability scanners, vendor advisories and corporate patch processes are built around those numbers. A flaw without one is close to invisible to the systems meant to catch it.
Kaiser’s timeline shows how this one stayed off the books. He reported the bug to Broadcom on July 18 and July 27. Broadcom replied that a patch already existed and told him device makers should contact the company directly. On July 29, Kaiser writes, Broadcom declined to register a CVE and would not share the notice it said it had sent to manufacturers.
He then went to CERT/CC, the coordination center that usually steps in when a vendor is unresponsive. It closed the case the same day. The reason is a quirk of the system: Broadcom is itself a CVE Numbering Authority, one of the organizations allowed to issue CVE numbers for its own products. When such a company decides its bug does not need a number, there is little anyone else in the process can do.
The result is a fix that existed in some form since 2018 but never reached many of the routers sitting in people’s homes. As of October 15, Kaiser said, none of the affected Belgian devices he had identified had been patched.
What owners can do
The obvious fix, switching off WPS in the router settings, is not reliable. Kaiser’s FAQ says plainly: “Do not assume so,” because a settings toggle may not turn off the vulnerable code. Changing the Wi-Fi password does not help either, since the attack does not need it.
What does work is action by the provider. Proximus disabled WPS across its whole BBOX fleet within 24 hours of being contacted, and Kaiser now tells Proximus customers they are covered. Telenet checked its fleet and found the vulnerable component was not running.
For everyone else, the practical steps are:
- Find your router’s model on the back label and check it against Kaiser’s list.
- Ask your internet provider or the manufacturer directly whether a firmware update addresses this specific issue.
- If the router is old, no longer updated, or uses one of the eCos chips, ask the provider for a replacement.
Router flaws tend to linger because nobody owns the problem: the chip maker supplies code, the manufacturer builds the box, and the provider installs it and rarely touches it again. We saw a similar chain of blame with cheap Android phones that ship with malware owners can’t remove.
Our take
The technical bug is ordinary; the paperwork failure is not. When a company can both own a flaw and decide whether it officially exists, a silent patch becomes a way to make a problem disappear on paper while millions of devices stay exposed. That approach was always risky, and it is getting worse: Kaiser says AI models let him finish in under a week research that would otherwise have taken months, and attackers have the same tools. As we noted with the WordPress flaw that was weaponized within hours, the time between disclosure and attack keeps shrinking. Vendors that act as their own CVE authority should be expected to register their own bugs, especially ones that sit inside other companies’ products for years.