As reported by The Hacker News, a critical unpatched vulnerability in Broadcom's Wi-Fi Protected Setup (WPS) implementation allows attackers within radio range to execute arbitrary code as root on affected routers — without knowing the Wi-Fi password or completing any pairing step. Security researcher Quentin Kaiser demonstrated the exploit on October 16 against ISP-issued gateways from three Belgian providers, including extracting a Wi-Fi PSK over the air and opening a reverse shell carried entirely over Wi-Fi frames. No CVE has been assigned, and no patch is available for many affected devices.
This is not a typical network vulnerability. The attack requires only physical proximity to a vulnerable device — no credentials, no prior access, and no network-side interaction. By exploiting a memory corruption bug in Broadcom's fragmented WPS message reassembly logic, Kaiser built both an information disclosure primitive (reading router memory) and a code execution primitive. The implications for ISP-issued consumer gateways, which are rarely updated and often sit unmonitored in homes and small offices for years, are severe.
Vulnerability Details
| Attribute | Details |
|---|---|
| Component | Broadcom Wi-Fi Protected Setup (WPS) implementation |
| Root Cause | Mishandled reassembly of fragmented WPS setup messages leading to memory corruption |
| Impact | Arbitrary code execution as root; memory disclosure (PSK extraction) |
| Attack Vector | Wi-Fi radio range — no credentials, no pairing required |
| CVE | Not yet assigned |
| CVSS / Severity | Critical (unofficial — remote pre-auth root code execution) |
| Patch Status | No fix deployed. Broadcom shipped incomplete fix in 2018; older chipsets are a permanent "forever day" |
| Active Exploitation | None reported in the wild (proof-of-concept only) |
Affected Chipsets
- eCos-based (likely unpatchable): BCM3380, BCM3383, BCM33834
- Linux-based (potentially patchable): BCM3390, BCM65xx, BCM68xx
Confirmed Exploitable ISP Gateways
- Orange Belgium — Askey TCG3000 (PSK extracted over the air)
- Proximus — Sagemcom BBOX3V+ (reverse shell over Wi-Fi frames)
- VOO — confirmed vulnerable
- Telenet — untested, likely affected
Why This Matters
The vulnerability's reach is the critical concern. Broadcom's WPS code is embedded in routers and access points from dozens of vendors worldwide — Cisco small-business APs, Huawei, ARRIS, Sagemcom, Askey, and many more. Kaiser estimates millions of affected devices. The flaw has existed since at least 2010, meaning an entire generation of Broadcom-based gateways has shipped with this defect for over 15 years.
The concept of a
forever day— a vulnerability the vendor will never patch — is particularly relevant here. Older eCos-based chipsets have no viable fix path. These devices will remain exploitable until they are decommissioned. For ISPs that have deployed these gateways at scale, there is no software remediation available; the only answer is hardware replacement.
For enterprises, the risk extends to any Broadcom-based small-business access points still in service, particularly in branch offices or IoT deployments where physical access controls to the wireless perimeter are weak.
Shield53 Recommendations
Immediate Actions
Strategic Actions
- Eliminate Broadcom eCos-based wireless equipment from your approved hardware standards.
- Add WPS disablement to your baseline router/AP hardening configuration templates.
- Incorporate firmware EOL and "forever day" risk into vendor risk assessments for all network equipment procurement.
This disclosure is a reminder that proximity-based wireless attacks remain a potent and underappreciated threat vector. Defenders who focus exclusively on internet-facing perimeter controls are blind to an attacker parked outside with a laptop and a Wi-Fi adapter. The absence of a CVE and the fragmented vendor ecosystem mean there will be no single advisory to track — organizations must take ownership of identifying and remediating this risk themselves.
