Broadcom Wi-Fi bug since 2010 allows unauthenticated router code execution
Original title: 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password
Quentin Kaiser demonstrated exploits on two Belgian ISP routers; Broadcom assigned no CVE after an incomplete 2018 fix.
Researcher Quentin Kaiser told Hexacon that a flaw in Broadcom’s proprietary 802.11 WPS EAP reassembly code has been in the SDK since at least 2010. An attacker in Wi-Fi range can disclose information and run code without the network key, a completed WPS enrollment, or user action. He showed working exploits against the Orange Belgium ASKEY TCG3000 and Proximus Sagemcom F@st/BBOX3V+. Broadcom shipped an incomplete fix in 2018, recommended hostapd, refused a CVE, and told him to contact OEMs.
Unconfirmed: The 1.5 million figure is Kaiser’s rough Belgian estimate; Telenet and the worldwide device count are unconfirmed.
- As of October 15, 2026, none of the affected devices in Belgium had been patched.
- eCos platforms named include BCM3380, BCM3383, and BCM33834; Linux names include BCM3390, BCM65xx, and BCM68xx.
- Kaiser reported the bugs to Broadcom in July 2026; CERT/CC closed its case the same day.
- His Belgian estimate is about 850,000 Proximus, 500,000 VOO, and 210,000 Orange devices.
- He is publishing a fingerprinting script and a YARA rule to map affected deployments.
Impact: Unauthenticated code execution and information disclosure over Wi-Fi
| Product | Affected | Fixed in |
|---|---|---|
| Broadcom proprietary 802.11 SDK | present since at least 2010 | incomplete fix in 2018; hostapd recommended |
| ASKEY TCG3000 | — | — |
| Sagemcom F@st/BBOX3V+ | — | — |
- 1.Ask affected OEMs whether they received Broadcom’s patch or migrated off the vulnerable stack.
- 2.Use Kaiser’s fingerprinting script and YARA rule to identify exposed gateway deployments.
- Products
- TCG3000F@st/BBOX3V+hostapd
- Organizations
- Orange BelgiumProximusCERT/CCVOO
- Countries
- Belgium
From the original article
4 min read at securityaffairs.com
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802. 11 implementation that has been present in their SDK since at least 2010.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.