Unpatched Broadcom WPS flaw lets nearby attackers run code as root
Original title: Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
Quentin Kaiser's own exploits read a Wi-Fi password and opened an over-the-air shell; he reports no real-world attacks.
Security researcher Quentin Kaiser disclosed on October 16 a flaw in Broadcom's Wi-Fi Protected Setup code that lets an attacker within radio range corrupt router memory and run code as root without the Wi-Fi password or pairing. He demonstrated it on Belgian provider gateways, including an Askey TCG3000 that returned the stored PSK and a Sagemcom BBOX3V+ that yielded a reverse shell over Wi-Fi frames. No CVE has been assigned and no fix has been deployed to the affected routers, he says. Older eCos chips have no usable fix; newer Linux-based models could be fixed if makers switch Wi-Fi software.
Unconfirmed: Kaiser says Broadcom has known since 2018 and refused a CVE; device counts and much of his wider vendor list are estimates or unconfirmed.
- Vulnerable families named are BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx and BCM68xx.
- Kaiser found the flaw exploitable at Proximus, Orange Belgium and VOO.
- He traces the code to at least 2010 and says Broadcom shipped an incomplete fix in 2018.
- CERT/CC closed the case the same day because Broadcom would not assign a CVE.
- YARA rules and a live listener are triage aids; a match is not confirmation.
Impact: root code execution over Wi-Fi without the network password
| Product | Affected |
|---|---|
| Broadcom Wi-Fi Protected Setup | eCos BCM3380, BCM3383, BCM33834; Linux BCM3390, BCM65xx, BCM68xx |
| Askey TCG3000 | — |
| Sagemcom BBOX3V+ | — |
- 1.Triage firmware with Kaiser's YARA rules and check live access points with his script.
- 2.Treat a rule match as a reason to investigate, not a confirmed finding.
- 3.Replace eCos-based gear that will never be fixed.
- Countries
- Belgium
From the original article
3 min read at thehackernews.com
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.