A security flaw in Broadcom’s Wi-Fi setup software could allow attackers within wireless range to take complete control of vulnerable routers without knowing the Wi-Fi password or completing any authentication process.
Security researcher Quentin Kaiser disclosed the issue on October 16, demonstrating how the vulnerability could expose network credentials and enable remote command execution over Wi-Fi.
Kaiser demonstrated the attacks against home internet gateways supplied by three Belgian internet providers. In one case, he extracted the Wi-Fi password directly from a router. In another, he gained access to a remote shell that allowed commands to be executed on the device over the wireless connection. According to the researcher, no CVE identifier has been assigned to the flaw, and affected devices have not received a working fix.
The vulnerability affects Broadcom’s implementation of Wi-Fi Protected Setup (WPS), a feature designed to make connecting devices to wireless networks easier. The software mishandles fragmented WPS messages, allowing an attacker to send specially crafted data that corrupts the router’s memory. Kaiser developed exploits that use this weakness to read sensitive information and execute code on vulnerable devices.
During testing against an Orange Belgium gateway, the Askey TCG3000, the exploit retrieved the Wi-Fi password stored on the device and transmitted it over the air. This allowed the attacker to obtain the network’s pre-shared key and subsequently connect to the network.
Kaiser also demonstrated an attack against a Sagemcom-built BBOX3V+ gateway supplied by Proximus. In that case, the exploit opened a reverse shell through Wi-Fi frames, giving the attacker a remote command-line interface without requiring an external server. Both demonstrations worked without logging in to the router, according to the researcher.
The potential impact extends beyond the devices tested in Belgium. Broadcom’s WPS implementation is used in routers and access points from multiple manufacturers, and Kaiser estimates that millions of devices worldwide could be affected. However, not every device identified in his research has been confirmed vulnerable.
The affected chipsets fall into two main groups. Older eCos-based models include the BCM3380, BCM3383 and BCM33834, while newer Linux-based models include the BCM3390, BCM65xx and BCM68xx. Kaiser says he could not identify a usable fix for the older devices, while newer models may be addressed by manufacturers switching to an alternative Wi-Fi software implementation.
In Belgium, the researcher confirmed that gateways supplied by Proximus, Orange Belgium and VOO were vulnerable during his testing. Telenet devices may also be affected, but he was unable to test them. His broader list includes equipment associated with manufacturers such as Cisco, Huawei and ARRIS, although some entries are based on automated checks that indicate possible exposure rather than confirmed exploitation.
The flaw appears to have existed for years. Kaiser traces the vulnerable code back to at least 2010 and says Broadcom introduced an incomplete fix in 2018 before recommending that customers move to an alternative software package called hostapd. According to his findings, older eCos-based devices never received a working fix.
The absence of a CVE identifier has also complicated the response. Kaiser says Broadcom had been aware of the issue since 2018 but declined to register a CVE or make a public announcement. He subsequently reported the case to the CERT Coordination Center, but the case was closed the same day because Broadcom controls CVE assignment for its products and did not provide an identifier.
With no general patch available, Kaiser has published YARA rules and a detection script on GitHub to help security teams identify potentially vulnerable devices. The tools can inspect extracted firmware or examine a live access point, but their results require further verification because even patched devices may trigger some of the checks.
For devices that cannot receive a working fix, replacing the affected hardware may be the most practical option. Kaiser also highlighted the risk posed by attacks launched from nearby locations, where an attacker could exploit vulnerable wireless equipment without needing direct access to the target’s internet connection.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The researcher said he had not observed real-world attacks exploiting the flaw and that the working exploits were developed by him. The findings nevertheless highlight the security risks associated with long-standing vulnerabilities in networking software that can remain embedded in internet gateways for years.
