A flaw in Broadcom’s Wi-Fi software can let someone within wireless range take control of vulnerable routers without knowing the Wi-Fi password.
The issue affects the company’s implementation of Wi-Fi Protected Setup (WPS), a feature designed to help devices join a wireless network.
Researcher Quentin Kaiser showed that the flaw could be used to read sensitive data and run code on affected devices, including code with root privileges—the highest level of control on a Linux-based system. Original research
The flaw is in the way Broadcom’s software handles parts of WPS messages sent over the air. A nearby attacker does not need to join the network, enter its password or complete the normal WPS setup process.
This is not a malware discovery: the report describes a weakness in router software that could be abused to gain access. The risk is serious because routers sit between users and the internet, and often carry traffic from many devices.
Researchers from QTNKSR identified and documented the vulnerability across Broadcom Wi-Fi platforms. Their findings describe memory disclosure and remote code execution on affected routers, with tests showing that the problem reaches devices supplied by several internet providers.
The flaw has been present in Broadcom’s software development kit since at least 2010, according to the researchers. It adds to concerns raised by earlier reports on Broadcom Wi-Fi chip flaws, though those earlier findings affected different products and components.
Broadcom’s software receives and reassembles fragmented messages used during WPS communication. Kaiser found that errors in this process could lead to memory corruption.
By carefully shaping the messages, he developed ways to disclose information from memory and execute code on vulnerable devices.
The publicly described demonstrations show the attack taking place over Wi-Fi; it does not depend on access to a router’s web administration page.
In one demonstration, the researcher used the code execution to retrieve the Wi-Fi network key stored on an Orange Belgium ASKEY TCG3000 gateway.
In another, he obtained a reverse shell from a Proximus gateway using Wi-Fi frames. These tests show why the weakness matters: an attacker may be able to move from being nearby to controlling the router, rather than merely disrupting a wireless connection.
The research also notes that the attack can work over distance, not only when an attacker is standing next to the device.
The risk is not limited to one router brand. The researchers confirmed the flaw on devices using Broadcom chips BCM3380, BCM3383 and BCM33834, which run eCos, and identified potential impact on Linux-based platforms using BCM3390, BCM65xx and BCM68xx.
Tested Belgian provider equipment included Proximus BBOX 3 and BBOX3V+, several VOO-supplied Netgear and Technicolor models, and Orange Belgium’s ASKEY TCG3000.
The researcher said the issue may affect a wider set of vendors and products, but a complete list is not yet available.
Patch status and exposure
The researcher reported that Broadcom’s software development kit included the flaw by 2010 and that a patch released in 2018 was incomplete. Broadcom reportedly advised moving to hostapd, an alternative Wi-Fi software implementation.
The researcher described the outlook as particularly difficult for affected eCos devices, while Linux-based products may be fixable if manufacturers make the required software change. As of October 15, 2026, the tested provider devices were reported as still unpatched.
Broadcom did not assign a CVE identifier to the issue, according to the disclosure timeline published by Kaiser.
The researcher said Broadcom had been informed in 2018, and that he reported the findings to Broadcom in July 2026. He also contacted affected providers and Belgium’s Cyber Security Center. This leaves owners dependent on their router maker or internet provider for clear advice and firmware updates.
Router owners should check their provider’s security notices and ask whether their exact model has an update or replacement available.
Do not assume a router is safe simply because its administration password is strong: this issue is triggered through Wi-Fi and does not require a login.
If a provider confirms that a model is affected but has no fix, replacing it with a supported device is a sensible step. Readers can compare the broader risks in GBHackers’ coverage of Ruckus router vulnerabilities and DrayTek router security flaws.
The findings also highlight a long-running supply-chain problem. Broadcom supplies technology used by many manufacturers, but router makers and internet providers decide which software reaches customers and when updates are delivered.
A fix in a chip supplier’s code does not automatically protect a device if its maker does not integrate and distribute that fix. For homes and businesses, checking update status with the provider is therefore essential.
Indicators of compromise (IoCs):-
| IoC type | Value reported in the source |
|---|---|
| SHA-256 or other file hashes | None reported |
| Malicious IP addresses or domains | None reported |
| Malware filenames or sample names | None reported |
| CVE identifier | None assigned, according to the researcher |
| Affected Broadcom chip families | BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx and BCM68xx |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
