Security researcher Quentin Kaiser disclosed on October 16 that a flaw in how Broadcom's Wi-Fi Protected Setup code reassembles fragmented setup messages lets an attacker within radio range run their own code as root on an affected router, with no Wi-Fi password, no pairing step, and no prior access to the network required. The bug has gone unfixed on some chips since at least 2018.
Kaiser demonstrated the attack against two internet-provider gateways in Belgium. On an Orange Belgium unit built on the Askey TCG3000, he extracted the stored Wi-Fi password from the device's memory and used it to rejoin the network. On a Proximus BBOX3V+ made by Sagemcom, he opened a reverse shell carried entirely over Wi-Fi frames, with no outside server involved at any point. He said the same flawed code is present on gateways from VOO and possibly Telenet, and that a broader, partly unverified list he compiled includes Cisco small-business access points and Huawei and Arris routers, putting an estimated millions of devices worldwide at risk.
The affected chips fall into two groups. Newer, Linux-based Broadcom chips, including the BCM3390, BCM65xx, and BCM68xx families, could still be fixed if device makers switch their Wi-Fi software. Older, eCos-based chips, including the BCM3380, BCM3383, and BCM33834, have no viable fix at all, a category Kaiser calls a "forever day."
Broadcom shipped a partial fix in 2018 and told customers to move to the open-source hostapd software instead, but Kaiser says no router has received a complete patch since. No CVE has ever been assigned, because Broadcom holds assignment authority for its own products and has declined to use it; the CERT Coordination Center closed his case for the same reason. Kaiser has published YARA rules and a network-scanning script on GitHub that can flag likely-vulnerable firmware, though he cautions both are triage aids rather than proof, since a hit still needs manual confirmation and a patched device can occasionally still match the rules. For the oldest chips, he says replacing the hardware is the only realistic fix. Kaiser frames the bug as especially useful to attackers who can get physically close to a target, rather than reach it over the open internet, a category of attack that has drawn wider attention after researchers documented a Russian state-linked group breaching a target by first compromising nearby organizations' Wi-Fi networks.
