A 16-year-old flaw in Broadcom’s Wi‑Fi software can let an attacker within wireless range take control of vulnerable routers without knowing the network password.
Security researcher Quentin Kaiser disclosed the vulnerability at Hexacon in Paris on October 16, 2026, warning that legacy code remains in many deployed devices.
Kaiser’s analysis shows the bug has been present in Broadcom’s software development kit since at least 2010. It affects Broadcom’s proprietary implementation of Wi‑Fi Protected Setup (WPS), enabling memory leaks and attacker-controlled code execution before normal WPS enrollment completes.
The problem lies in the code that reassembles fragmented Extensible Authentication Protocol (EAP) messages used by WPS. Weak length checks allow specially crafted wireless frames to overflow a memory buffer.
An attacker who can reach the target over the air can then read or modify memory and hijack the router’s execution flow to run arbitrary code. This is an over‑the‑air exploit, not a password‑cracking technique: the attacker needs wireless proximity but not the network key.
In one demonstration Kaiser extracted the saved Wi‑Fi password from an Orange Belgium ASKEY TCG3000 router and transmitted it back inside wireless frames, then used the stolen password to join the network.
In a second demo against a Proximus BBOX3V+ he obtained a remote command shell delivered over Wi‑Fi frames without relying on a cloud command server. These tests illustrate why a strong Wi‑Fi password alone cannot prevent exploitation of the affected software.
Kaiser confirmed successful exploitation on devices deployed by three Belgian internet providers. Affected models include Proximus BBOX3V+, VOO’s Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233, and Orange’s ASKEY TCG3000. Possible exposure involving Telenet equipment remained unconfirmed at the time of his presentation.
He estimates the Belgian fleet affected at roughly 1.56 million gateways across Proximus, legacy VOO, and Orange; these are researcher estimates, not provider‑verified totals. Kaiser warns the underlying issue could affect millions of access points worldwide, though a comprehensive count is not available.
The finding follows earlier Broadcom‑related wireless security concerns, such as the separate Kr00k vulnerability. This new research targets WPS message handling rather than that earlier bug.
Kaiser characterizes a 2018 Broadcom patch as incomplete. Slides reproduced correspondence in which Broadcom said it had long been aware of the issue and had offered replacement software based on hostapd and WPA Supplicant since 2018; device manufacturers are responsible for migrating away from the older implementation.
Kaiser reported the eCos issue on July 18 and the Linux issue on July 27. He says Broadcom declined to assign a CVE, and the Belgian devices he tested remained unpatched as of October 15.
His detection toolkit includes a wireless fingerprinting script and YARA rules for firmware scans. Kaiser stresses these are screening tools rather than definitive proof of exploitability and that findings require further review.
The vulnerability also highlights the relevance of Nearest‑Neighbor attacks, in which compromised nearby systems provide the wireless reach needed for exploitation. While those attacks used different techniques, they underscore why nearby Wi‑Fi exposure matters.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
