Unpatched Broadcom WPS Flaw Lets In-Range Attackers Run Root Code on Routers
A memory-corruption vulnerability in Broadcom's proprietary Wi-Fi Protected Setup (WPS) implementation lets an attacker within ordinary Wi-Fi radio range execute code as root on Broadcom-based routers and gateways — without the Wi-Fi password, without completing any WPS pairing step, and without any user interaction. Security researcher Quentin Kaiser, Lead Security Researcher at ONEKEY Research Lab, disclosed the flaw publicly on October 16, 2026, at the Hexacon security conference in Paris, in a talk titled "One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux." Kaiser says the vulnerable code has existed in Broadcom's software development kit since at least 2010, and that Broadcom has refused to assign a CVE or notify the public, despite being notified of the bug roughly three months before disclosure.
Vulnerability Details
| Attribute | Value |
|---|---|
| Researcher | Quentin Kaiser, Lead Security Researcher, ONEKEY Research Lab |
| Disclosed | October 16, 2026, at Hexacon (Paris) |
| Root cause | Buffer overflow in Broadcom's WPS code when reassembling fragmented EAP setup messages |
| Impact | Memory corruption leading to information disclosure and arbitrary code execution as root |
| Authentication required | None — no Wi-Fi password, no completed WPS enrollment, no user interaction |
| Attack range | Standard Wi-Fi radio range; works at a distance, not only in close proximity |
| Affected chipsets (eCos) | BCM3380, BCM3383, BCM33834 — no usable fix exists ("forever day") |
| Affected chipsets (Linux) | BCM3390, BCM65xx, BCM68xx — a remediation path exists via vendor migration |
| CVE assigned | None — Broadcom declined to register one |
| Patch status | Unpatched on every surveyed deployed router as of October 19, 2026 |
| Known exploitation | None reported in the wild; Kaiser's proof-of-concept exploits are the only known working code |
How It Works
A 16-Year-Old Parsing Bug
WPS is the feature that lets a device join a Wi-Fi network without a user typing the password — commonly triggered by a PIN exchange or a physical button press. Broadcom ships its own proprietary WPS implementation inside the Wi-Fi stack baked into its chipsets, rather than relying on the open-source hostapd daemon that many other vendors use. Kaiser found that this code mishandles the reassembly of fragmented EAP (Extensible Authentication Protocol) messages sent during the WPS exchange. A crafted sequence of fragments causes a buffer overflow that corrupts router memory, and because the parser accepts these messages before any password or pairing check occurs, the bug is reachable by anyone within radio range — no credentials, no victim interaction, and no prior relationship with the network required.
Two Chipset Families, Two Outcomes
Kaiser's research splits the affected hardware into two groups:
- eCos-based chipsets — BCM3380, BCM3383, and BCM33834 — run Broadcom's older eCos embedded real-time operating system. Kaiser found no usable fix for these devices and coined the term "forever day" for the bug on this platform: a vulnerability that will never be patched because the underlying software stack is no longer realistically maintainable for a security fix.
- Linux-based chipsets — BCM3390, BCM65xx, and BCM68xx — run embedded Linux, which gives vendors a theoretical remediation path: migrating away from Broadcom's proprietary WPS stack to hostapd, which is what Broadcom itself recommended when Kaiser reported the bug.
Proof-of-Concept Attacks Against Real ISP Gateways
Kaiser demonstrated working exploits against home gateways issued by Belgian internet service providers:
- Orange Belgium's Askey TCG3000 — the exploit read the Wi-Fi pre-shared key (PSK) directly out of the router's stored configuration, transmitted it back to the attacker over the air, and then used that recovered password to join the network as a legitimate client.
- Proximus's Sagemcom BBOX3V+ — the exploit opened a reverse shell carried entirely inside Wi-Fi management frames, giving the attacker a remote command line on the router without needing any external command-and-control server or network path beyond radio range.
Both attacks ran without any login and without completing a WPS enrollment, and Kaiser notes the exploit works at a genuine distance rather than requiring the attacker to be pressed up against the device.
Scale of Exposure
Kaiser estimates more than 1.5 million vulnerable gateways in Belgium alone, broken down roughly as:
- Proximus — approximately 850,000 devices
- VOO — approximately 500,000 devices
- Orange Belgium — approximately 210,000 devices
Because the same Broadcom chipsets and WPS code ship inside routers and access points from dozens of vendors worldwide, Kaiser believes the true global exposure runs into the millions of devices, even though Belgium is the only market where he confirmed end-to-end working exploits against production ISP hardware.
Disclosure Timeline
Kaiser reported the vulnerability to Broadcom's product security team in July 2026. Broadcom responded that a fix had existed internally since 2018 and directed device manufacturers to contact Broadcom directly to obtain it, but it declined to assign a CVE identifier or publish any advisory. The standard 90-day coordinated disclosure window lapsed on October 15, 2026, with no patch having reached any of the ISP routers Kaiser surveyed. He went public the next day at Hexacon.
Impact Assessment
| Impact Area | Description |
|---|---|
| Unauthenticated root access | Attackers in Wi-Fi range can run arbitrary code as root with no password, pairing step, or user interaction |
| Credential theft | Demonstrated recovery of the Wi-Fi PSK directly from router memory on at least one gateway model |
| Persistent backdoor risk | A reverse-shell exploit path means an attacker can establish ongoing remote access without touching the network password |
| Permanent exposure on older hardware | eCos-based chipsets (BCM3380/3383/33834) have no usable fix — Kaiser's "forever day" — leaving replacement as the only real remedy |
| No CVE, no advisory | Broadcom's refusal to assign a CVE or publish guidance makes it harder for downstream ISPs and enterprises to track, scan for, or formally remediate the flaw |
| Scale | Over 1.5 million gateways estimated vulnerable in Belgium alone; millions more plausible globally given how widely Broadcom's Wi-Fi chipsets are OEM'd |
Recommendations
For ISPs and Router Manufacturers
- Disable WPS by default in shipped firmware for any gateway built on the affected Broadcom chipsets, since the vulnerable code path lives entirely inside WPS message parsing.
- Contact Broadcom directly for the 2018 fix referenced in its response to Kaiser, and prioritize migrating Linux-based gateway firmware (BCM3390/65xx/68xx) to the hostapd-based WPS implementation Broadcom itself recommends.
- Plan for hardware replacement, not patching, on eCos-based deployments (BCM3380/3383/33834); be transparent with subscribers about which gateway models cannot be fixed in place.
- Push a firmware update that disables WPS remotely for already-deployed gateways where possible, as an interim mitigation while a full fix is developed.
For Security Teams
- Use Kaiser's released detection tooling — YARA rules for spotting the vulnerable code pattern in extracted firmware images, plus a script for probing live access points — to triage which deployed hardware in your environment may be exposed. Treat results as preliminary triage, not definitive confirmation.
- Inventory Broadcom-chipset routers and access points across managed environments, including branch-office and remote-worker gateways supplied by ISPs, since this bug sits below the level most asset inventories track.
- Monitor for unusual WPS/EAP traffic at the network edge where visibility permits, given the bug is triggered by crafted WPS fragment sequences rather than normal traffic patterns.
For Home and Small-Office Users
- Disable WPS in your router's admin settings now. This is the single most effective mitigation available today, since it removes the vulnerable code path from being reachable.
- Change default administrator credentials on your router if you haven't already, to limit damage from any secondary access the exploit might enable.
- Check for and install any firmware update from your ISP or router vendor, and ask your provider directly whether your specific gateway model is affected.
- If your ISP confirms your router uses an eCos-based Broadcom chipset, request a replacement device — no software fix is coming for that hardware.
Key Takeaways
- Security researcher Quentin Kaiser of ONEKEY Research Lab disclosed an unauthenticated, root-level code execution flaw in Broadcom's proprietary WPS Wi-Fi implementation on October 16, 2026, at Hexacon in Paris.
- The bug is a buffer overflow in how Broadcom's code reassembles fragmented WPS EAP messages, present in Broadcom's SDK since at least 2010, and requires no password, no WPS pairing, and no user interaction — only radio range.
- Kaiser demonstrated working exploits against real ISP gateways: PSK theft from Orange Belgium's Askey TCG3000 and a reverse shell over Wi-Fi frames on Proximus's Sagemcom BBOX3V+.
- Older eCos-based Broadcom chipsets (BCM3380/3383/33834) have no usable fix — what Kaiser calls a permanent "forever day" — while newer Linux-based chipsets (BCM3390/65xx/68xx) have a remediation path through migrating to hostapd.
- Broadcom declined to assign a CVE or publish an advisory despite being notified in July 2026; the 90-day disclosure window closed on October 15, 2026 with no patch deployed to any surveyed router.
- Kaiser estimates over 1.5 million vulnerable gateways in Belgium alone, with millions more plausible worldwide given how broadly these Broadcom chipsets are licensed to router and access-point vendors — disabling WPS is the most immediate step available to any affected user today.