Broadcom WPS Defect Enables Nearby Root Access to Routers

Security researcher Quentin Kaiser has disclosed an unpatched flaw in Broadcom’s implementation of Wi-Fi Protected Setup (WPS) that can allow an attacker within radio range to execute code as root on affected routers. The attack requires neither the Wi-Fi password nor a pairing step. Kaiser demonstrated it against gateways supplied by Belgian providers Orange Belgium, Proximus and VOO, with no CVE assigned and no deployed fix for the affected devices.

The issue lies in the way Broadcom’s WPS software reassembles fragmented setup messages. Crafted Wi-Fi frames can corrupt router memory, giving an attacker a route to read memory from the device and to execute their own code. WPS is intended to let devices join a wireless network without manually entering its password, making the vulnerable component particularly significant for equipment exposed over the air.

Demonstrations recovered credentials and opened a shell

On an Orange Belgium Askey TCG3000 gateway, Kaiser’s exploit read the pre-shared key from stored router settings, returned it over Wi-Fi and used it to join the network. On a Proximus Sagemcom BBOX3V+ gateway, he opened a reverse shell carried through Wi-Fi frames, so the demonstration did not require an external server. Kaiser said the attack works from a distance rather than only at close range.

He reported no known real-world exploitation. The working exploits described in the disclosure are his own. However, the affected WPS code appears in routers and access points from many vendors, and Kaiser estimates that millions of devices worldwide could be exposed. His broader vendor list includes confirmed and unconfirmed entries, with some devices marked only as likely vulnerable by automated checks.

Older chip families may have no remediation path

Kaiser identified older eCos-based Broadcom models—BCM3380, BCM3383 and BCM33834—as having no usable fix, describing the condition as a “forever day.” Newer Linux-based BCM3390, BCM65xx and BCM68xx models could be remediated if manufacturers move to different Wi-Fi software. The code dates back to at least 2010; Kaiser said Broadcom issued an incomplete fix in 2018 and advised customers to use hostapd instead.

The absence of a CVE complicates inventory and tracking. Kaiser said Broadcom knew of the issue from 2018 but did not assign an identifier or issue a public statement. The CERT Coordination Center closed the case because Broadcom holds CVE assignment authority for its products. The remediation challenge resembles the infrastructure boundary highlighted by root access beyond isolation boundaries when software flaws create routes to root-level control beyond an expected isolation layer.

Inventory and replacement are the practical next steps

Kaiser released YARA rules for extracted firmware and a script that listens to a live access point for signs of vulnerable code. These are triage aids: a patched device may still match the rules, so a positive result requires further validation rather than serving as proof of exposure.

There is no identified configuration setting that blocks this over-the-air attack, and permanently unsupported devices cannot receive a corrective update. Businesses should inventory Broadcom-based wireless equipment, validate potentially affected models and plan replacement for hardware with no viable patch path.