As reported by SecurityAffairs, researcher Quentin Kaiser disclosed a 16-year-old vulnerability in Broadcom's proprietary 802.11 implementation at Hexacon in Paris, enabling unauthenticated remote code execution on affected routers within Wi-Fi range. The flaw resides in the WPS EAP reassembly code and has been present in Broadcom's SDK since at least 2010.

Security Impact: As reported by SecurityAffairs, researcher Quentin Kaiser disclosed a 16-year-old vulnerability in Broadcom's proprietary 802.11 implementation at Hexacon in Paris, enabling unauthenticated remote code execution on affected routers within Wi-Fi range.

This disclosure illustrates a structural failure in the IoT and ISP equipment supply chain that goes well beyond a single bug. Broadcom released an incomplete patch silently in 2018, then recommended OEMs migrate to hostapd rather than fully fixing the proprietary stack. For eCos-based platforms, this is a confirmed forever day. For Linux-based platforms, remediation depends entirely on whether each OEM is willing to invest in migration — and history tells us most will not.

What Makes This Dangerous

  • No credentials required: The attacker doesn't need the Wi-Fi password or WPS enrollment completion. Proximity to the access point is sufficient.
  • Full device compromise: Demonstrated exploits achieved arbitrary code execution and extracted the PSK from NVRAM, effectively granting network access and persistent control.
  • Reverse shell over Wi-Fi frames: The attack doesn't require internet-accessible C2 infrastructure, making detection through network egress monitoring ineffective.
  • Mass deployment exposure: ISP-issued consumer routers from Orange Belgium (ASKEY TCG3000) and Proximus (Sagemcom F@st/BBOX3V+) were demonstrated as vulnerable. These device models are deployed in large fleets across European households.

Broader Implications

The root cause here is a supply chain accountability gap. Broadcom provides the chipset and SDK. OEMs build the firmware. ISPs distribute the device. When a flaw is discovered this far down the stack, no single party is incentivized to remediate — especially when the affected product line is end-of-sale or the OEM lacks the engineering capacity to migrate to an alternative implementation. The result is millions of devices that will never be patched.

The 2018 "incomplete patch" is particularly troubling. Silent partial fixes mean defenders who track advisories may believe they're protected when they are not. This underscores the need for independent validation of vendor patches, not trust in release notes.

Who Is at Risk

  • ISP-issued consumer routers based on Broadcom BCM3380, BCM3383, BCM33834 (eCos) — permanently exposed
  • Devices based on BCM3390, BCM65xx, BCM68xx (Linux) — potentially exposed pending OEM migration
  • Enterprise environments using affected Broadcom-based APs in guest or IoT VLANs
  • Hospitality and multi-tenant environments where physical Wi-Fi proximity is trivial

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Inventory and identify: Audit all Broadcom-based wireless devices in your environment. Cross-reference chipset models against the affected list. ISP-issued CPE should be a priority.
Contact your ISP or OEM: If you operate affected ISP-issued routers, demand a firmware update or device replacement. Cite the Hexacon disclosure explicitly.
Reduce attack surface: Where patching is not possible, disable WPS on affected devices if configurable. While Kaiser's research targets WPS EAP reassembly, disabling WPS reduces the exposed code path.
Segment Wi-Fi networks: Ensure IoT and guest Wi-Fi segments are isolated from critical infrastructure. A compromised consumer router should not have a path to sensitive internal resources.
Layer detection: Since the attack operates entirely over 802.11 frames, deploy wireless intrusion detection (WIDS) to monitor for anomalous EAP frame patterns and unexpected deauth or reassociation behavior near affected devices.
Plan for replacement: For confirmed forever-day devices, budget for hardware replacement. No software mitigation will close this gap.

Strategic Guidance

Security teams should add Broadcom SDK version tracking to their vendor risk management program. When a chipset vendor recommends architectural migration as the remediation path, treat that as a signal that the affected product line is effectively unsupported. Factor this into procurement decisions — ask OEMs whether their firmware is based on Broadcom's proprietary 802.11 stack or hostapd before purchase.