Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

16-year Broadcom Wi-Fi flaw still unpatched on tested Belgian gateways

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Broadcom Wi-Fi SDK flaw from at least 2010 can run code before WPS enrollment; tested Belgian gateways remain unpatched and have no CVE.

Quentin Kaiser of QTNKSR disclosed at Hexacon on October 16 a Broadcom Wi-Fi SDK flaw present since at least 2010 in proprietary WPS handling. Weak length checks while reassembling fragmented EAP messages can leak memory and run attacker code over the air, including as root, before enrollment and without the network password. He demonstrated it on gateways used by Proximus, VOO and Orange in Belgium and estimates about 1.56 million affected Belgian devices; Telenet exposure and the worldwide count are unknown. Confirmed chips include BCM3380, BCM3383 and BCM33834 on eCos; Linux platforms using BCM3390, BCM65xx and BCM68xx may also be affected. Broadcom declined a CVE, a 2018 move toward hostapd was incomplete, and tested provider devices remained unpatched as of October 15, 2026.

Key facts
  • Demos hit Orange ASKEY TCG3000 and Proximus BBOX3V+ over Wi-Fi frames.
  • Also named: VOO Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233.
  • Kaiser estimates about 1.56 million affected Belgian devices.
  • He reported the eCos issue on July 18 and the Linux issue on July 27, 2026.
  • Broadcom was told in 2018, according to Kaiser, and declined a CVE.
  • He released a fingerprinting script and YARA rules for screening only.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 18, 2026Kaiser reported the eCos issue to Broadcom. · Cyber Security News
  2. Jul 27, 2026Kaiser reported the Linux issue. · Cyber Security News
  3. Oct 15, 2026Tested Belgian provider devices remained unpatched. · GBHackers
  4. Oct 16, 2026Kaiser disclosed the flaw at Hexacon. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security News1.56 million Belgian estimate, model names, July dates, screening tools.
  • GBHackersConfirmed and possible chip families, root shell, 2018 notice.
Vendors
BroadcomNetgearTechnicolorASKEY
Products
WPSTCG3000BBOX3V+CG3100CG3700TC7210CGA4233Broadcom Wi-Fi SDKASKEY TCG3000
Organizations
ProximusVOOOrangeQTNKSROrange Belgium
Countries
Belgium

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Cyber Security NewsFirst report

    16-year-old Broadcom WPS flaw can give nearby attackers router control

    Researcher demos stole a Wi-Fi password and opened a shell without the network key; tested Belgian gateways were still unpatched.

  2. · 6d ago GBHackers

    Broadcom WPS flaw lets nearby attackers gain root on Wi-Fi routers

    The bug has sat in Broadcom’s SDK since at least 2010, has no CVE, and tested Belgian gateways were still unpatched.