Broadcom WPS flaw lets nearby attackers gain root on Wi-Fi routers
Original title: Researchers Hack Broadcom Wi-Fi Routers Without Passwords and Gain Full Root Access
The bug has sat in Broadcom’s SDK since at least 2010, has no CVE, and tested Belgian gateways were still unpatched.
Quentin Kaiser of QTNKSR showed that errors while Broadcom software reassembles Wi-Fi Protected Setup messages can disclose memory and run code, including as root, without the Wi-Fi password or a completed WPS exchange. Demonstrations retrieved the key from an Orange Belgium ASKEY TCG3000 and opened a reverse shell on a Proximus gateway. A 2018 SDK fix was incomplete; Broadcom advised moving to hostapd, and tested provider devices remained unpatched as of October 15, 2026.
Unconfirmed: The full set of affected products is unknown, and no CVE was assigned, according to the researcher.
- Confirmed chips include BCM3380, BCM3383 and BCM33834 running eCos.
- Linux platforms using BCM3390, BCM65xx and BCM68xx may also be affected.
- Kaiser said Broadcom was told in 2018 and he reported findings in July 2026.
- Tested gear included Proximus BBOX models, VOO Netgear and Technicolor units, and Orange’s ASKEY TCG3000.
- A complete vendor and product list is not yet available.
Impact: Nearby attacker can run root code and read the Wi-Fi key
| Product | Affected |
|---|---|
| Broadcom Wi-Fi SDK WPS implementation | present since at least 2010 |
- 1.Check the provider’s security notices for the exact router model.
- 2.Ask whether a firmware update or replacement is available.
- 3.Replace the device if the provider confirms it is affected and unfixed.
- Vendors
- Broadcom
- Products
- Broadcom Wi-Fi SDKASKEY TCG3000
- Organizations
- QTNKSROrange BelgiumProximusVOO
- Countries
- Belgium
From the original article
4 min read at gbhackers.com
A flaw in Broadcom’s Wi-Fi software can let someone within wireless range take control of vulnerable routers without knowing the Wi-Fi password. The issue affects the company’s implementation of Wi-Fi Protected Setup (WPS), a feature designed to help devices join a wireless network. Researcher Quentin Kaiser showed that the flaw could be used to read […]
By Tushar Subhra · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.