Vulnerabilities

On October 16, at the Hexacon conference in Paris, researcher Quentin Kaiser disclosed a memory corruption bug in Broadcom's Wi-Fi Protected Setup (WPS) code, the feature behind the "push the button to connect" pairing on routers. Anyone within radio range can trigger it without the Wi-Fi password and without completing a WPS pairing, and on the gateways he tested it gave him code execution as root. He named it WPSplinter. Broadcom declined to assign a CVE, and as of October 15 none of the devices he tested had been patched.

The vulnerable component, Broadcom's WPS Monitor, has shipped in its 802.11 software development kit (SDK) since at least 2010, and router makers built it into their own firmware. Kaiser's public device list names products sold by Cisco, Netgear, TP-Link, Nokia and ZTE and gateways handed out by ISPs including Movistar, and he estimates millions of affected access points worldwide. If you run small office routers, branch access points or ISP-supplied gateways on a Broadcom chip, assume you are in scope until you have checked.

How it works

WPS lets a new device join a network by exchanging a short series of registration messages with the access point, carried inside EAP (Extensible Authentication Protocol) frames. Some of those messages are larger than one frame, so the protocol splits them into fragments and the access point glues the fragments back together in a buffer before parsing the result.

Broadcom's WPS Monitor does not check that the reassembled message fits in its destination buffer. An attacker who sends crafted fragments that add up to more than the buffer holds can write past its end and corrupt memory. Kaiser turned that into two primitives: controlled memory disclosure, which reads data out of the device, and arbitrary code execution. The exact privileges depend on the product and firmware, but on the gateways he demonstrated, the code ran as root.

The parser is reachable before any enrollment finishes, because accepting registration messages from unknown devices is the whole point of WPS. That is why the network key gives no protection, and why changing the Wi-Fi password does nothing.

Broadcom told Kaiser that a fix has existed since 2018. In practice that meant an incomplete patch released without public notice, followed by advice to replace WPS Monitor with hostapd, the open source access point daemon. That leaves two groups of chips:

• On eCos-based platforms (BCM3380, BCM3383, BCM33834), Kaiser calls it a "forever day": there is no migration path, so no fix is coming.
• On Linux-based platforms (BCM3390, BCM63xx, BCM65xx, BCM68xx), a fix is possible only if the device maker or ISP moves its firmware to hostapd.

A matching chip alone does not prove a device is vulnerable. What matters is whether the firmware still runs the legacy WPS Monitor.

What has been shown so far

Kaiser reported the bug to Broadcom on July 18 and 27, 2026, and followed a 90-day disclosure deadline that ended with the Hexacon talk. CERT/CC closed his case the same day he opened it, because Broadcom is its own CVE Numbering Authority (CNA) and would not issue one.

His demonstrations used Belgian ISP equipment. On an Orange Belgium ASKEY TCG3000, his shellcode read the Wi-Fi key in cleartext from the device's NVRAM, sent it back over the air, and he then joined the network with it. On a Proximus Sagemcom F@st (BBOX3V+), he opened a reverse shell carried entirely in 802.11 frames, so the attacker needs no internet server to control the device. He estimates about 1.56 million affected gateways in Belgium alone, across Proximus, the legacy VOO fleet and Orange. That figure is his own estimate, not a number from the ISPs.

Kaiser reports no exploitation in the wild so far. The attacker has to be within Wi-Fi range, so this suits targeted attacks on a chosen office or home, against devices whose owners have almost no visibility into them. Once the gateway is taken, every device behind it shares a network with the attacker, and the gateway itself can watch or redirect traffic.

What to do

There is nothing to patch today for most affected devices, so the work is inventory, pressure on suppliers, and containment.

1. List every router and access point you do not fully control. That includes branch office routers, small business access points, and the ISP gateway at every site and in staff home offices that connect to company resources. Record make, model, hardware revision and firmware version. Compare against Kaiser's affected-device list on GitHub, which he says is incomplete.
2. Ask the supplier directly. For ISP gateways, ask the provider whether the firmware uses Broadcom's legacy WPS Monitor and when it will move to hostapd. ISP gateways usually take firmware only from the provider, so a fix has to come from them. For your own hardware, ask the vendor the same question and get the answer in writing.
3. Turn WPS off, then check it is really off. Disable WPS (sometimes labelled "WPS PIN" or "push button connect") in the admin interface. Kaiser warns that the setting may not remove the vulnerable parser, so treat this as risk reduction only. Confirm from a laptop that the network no longer advertises WPS: on Linux, sudo iw dev wlan0 scan prints a WPS section for each network that still offers it.
4. Replace or isolate what cannot be fixed. An eCos-based gateway will not get a fix. Where the ISP allows it, put the gateway in bridge mode, switch its Wi-Fi radios off and serve Wi-Fi from your own access points on current firmware. If the radios cannot be turned off, ask the ISP for a replacement model. Treat any Wi-Fi a vulnerable gateway still serves as untrusted, and keep corporate traffic on a VPN or behind your own firewall.
5. Check with the published tools. Kaiser's toolkit contains YARA rules to run against extracted firmware (yara -w -r broadcom_wps_monitor.yar <firmware_dir>) and a fingerprinting script that tests a live access point over the air using a wireless adapter in monitor mode. Both are triage aids, so confirm any match against the exact firmware.

There are no known indicators of compromise yet. If a device is flagged and you suspect it was touched, look for admin accounts, DNS settings, port forwards or remote management options you did not configure. Assume the Wi-Fi key has been read, and change it once the device is replaced or its radio is off, since changing it on a still-vulnerable device achieves nothing.

The wider lesson

This bug has lived for 16 years. Kaiser's view is that Broadcom's refusal to issue a CVE or say anything publicly is probably why so many device makers never shipped the 2018 fix. It also means scanners that match on CVE IDs will not flag it. Keep a record of the chipset and firmware lineage for network edge devices, and treat ISP gateways as hardware you are responsible for, even when the contract says the provider maintains them.

Our network penetration testing covers wireless and edge devices at every site, and our attack surface management work keeps that inventory current. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Quentin Kaiser, One Parser, Two Bugs, Many Routers, WPSplinter disclosure page, Broadcom WPS detection toolkit, The Hacker News, Cyber Kendra, Cybersecurity News, Techzine, The Register.