16-year-old Broadcom WPS flaw can give nearby attackers router control
Original title: 16-Year-Old Broadcom Wi-Fi Flaw Lets Attackers Hack Routers Without Knowing Passwords
Researcher demos stole a Wi-Fi password and opened a shell without the network key; tested Belgian gateways were still unpatched.
Quentin Kaiser disclosed at Hexacon on October 16 a Broadcom Wi-Fi SDK flaw present since at least 2010 in proprietary WPS handling. Weak length checks on fragmented EAP messages can leak memory and run attacker code over the air before enrollment, without the network password. He demonstrated exploitation on gateways used by Proximus, VOO and Orange in Belgium and estimates about 1.56 million affected Belgian devices. Broadcom declined a CVE; tested devices remained unpatched as of October 15, and a 2018 hostapd-based replacement was described as incompletely adopted.
Unconfirmed: Belgian totals are researcher estimates; Telenet exposure and the global device count are unconfirmed, and no CVE was assigned.
- Demos hit Orange ASKEY TCG3000 and Proximus BBOX3V+ over Wi-Fi frames.
- Also named: VOO Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233.
- Telenet exposure is unconfirmed; the worldwide device count is unknown.
- Kaiser reported the eCos issue on July 18 and the Linux issue on July 27.
- He released a fingerprinting script and YARA rules as screening tools only.
Impact: Over-the-air code execution and theft of saved Wi-Fi passwords
| Product | Affected |
|---|---|
| Broadcom Wi-Fi SDK WPS implementation | since at least 2010 |
| ASKEY TCG3000 | — |
| Proximus BBOX3V+ | — |
| Netgear CG3100 and CG3700 | — |
| Technicolor TC7210 and CGA4233 | — |
- 1.Review Kaiser’s wireless fingerprinting script and YARA rules against gateway firmware.
- 2.Treat nearby Wi-Fi exposure as a risk until vendors replace the old WPS code.
- Countries
- Belgium
From the original article
2 min read at cybersecuritynews.com
A 16-year-old flaw in Broadcom’s Wi-Fi software can let attackers within wireless range take control of affected routers without knowing the network password. Security researcher Quentin Kaiser disclosed the issue at Hexacon in Paris on October 16, 2026, warning that old code remains in widely deployed devices. According to Kaiser’s research, the flaw has existed […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.