Broadcom's WPS Bug Lets Anyone Nearby Run Code as Root on Your Router, and There's No Patch Coming
A security researcher has found a way to take full control of Broadcom-based routers from across the street, no password required, no pairing needed, just a Wi-Fi signal and some crafted packets.
Quentin Kaiser disclosed the vulnerability on October 16, demonstrating working exploits against home gateways supplied by three Belgian ISPs. In one case he pulled the Wi-Fi password straight off the device. In another, he opened a reverse shell carried entirely over Wi-Fi frames, no external server involved. Both attacks ran without any prior authentication and worked at range, not just arm's length.
The bug lives in Broadcom's implementation of Wi-Fi Protected Setup, the feature that lets devices join a network without manual password entry. Broadcom's code doesn't handle fragmented WPS messages properly. Send the right crafted sequence and you corrupt the router's memory. Kaiser built two things from that primitive: an arbitrary memory read and remote code execution as root.
No CVE has been assigned. No patch has been pushed to affected devices.
Old Code, Older Problems
Kaiser traces the vulnerable code back to at least 2010. Broadcom shipped what turned out to be an incomplete fix in 2018, then quietly told customers to migrate to a different Wi-Fi software stack called hostapd rather than stand behind their own patch. On older eCos-based chips, including the BCM3380, BCM3383 and BCM33834, no working fix was ever shipped. Kaiser calls these a "forever day", flaws that will simply never be patched on deployed hardware.
Newer Linux-based Broadcom chips, the BCM3390, BCM65xx and BCM68xx families, could theoretically be fixed if manufacturers update their software stack, but that requires vendors to actually care enough to act.
The affected hardware spans routers and access points from dozens of manufacturers. Kaiser estimates millions of devices worldwide carry the vulnerable code, with confirmed or likely-confirmed exposure at Proximus, Orange Belgium and VOO in Belgium alone. That's hundreds of thousands of gateways right there. Cisco small-business access points, Huawei kit and ARRIS routers also appear on his broader list, though some entries are flagged as probable rather than confirmed.
Why There's No CVE
Broadcom controls its own CVE assignment authority. Kaiser says the company acknowledged knowing about this bug since 2018 and admitted others had reported it before him, but refused to register a CVE or say anything publicly. Without a CVE, device makers have no standard tracking identifier to act on, which goes a long way toward explaining why so many never bothered patching.
When Kaiser escalated to the CERT Coordination Center, the case was closed the same day. CERT can't force a CVE out of a vendor that controls its own numbering authority. Broadcom simply chose silence.
What You Can Actually Do
Not much, frankly. There's no patch available and no configuration setting that blocks the attack. Kaiser has published YARA rules for identifying vulnerable code in firmware images and a script that can probe a live access point and flag whether it looks susceptible. Both are triage tools, not definitive answers. A patched device can still trigger a match, so a positive result means investigate further, not confirmed vulnerable.
For gear on the older eCos chips, the realistic answer is replacement. These devices aren't getting fixed.
Kaiser notes the attack profile fits a particular threat model well: adversaries who can get within radio range of a target rather than reaching them over the internet. Russian state-linked hackers have used exactly this kind of proximity attack to breach networks from nearby buildings. A bug that hands root access over Wi-Fi, with no credentials and no patch on the horizon, is precisely the kind of thing those operations look for.