Broadcom WPS flaw disclosed October 16, no fix yet

Quentin Kaiser’s exploit reads the Wi-Fi password off an Orange Belgium gateway, sends it back over the air, and joins the network, all without anyone typing a password or pairing a device. He disclosed the underlying flaw on October 16: a bug in Broadcom’s Wi-Fi Protected Setup code that lets an attacker within radio range run code as root on Broadcom-based routers. No CVE has been assigned. No fix has reached the affected routers.

WPS is the feature that lets a device join a network without the password being typed in. Broadcom’s version mishandles the reassembly of fragmented WPS setup messages. An attacker in range sends crafted messages that corrupt the router’s memory, and from that corruption Kaiser built two primitives: a way to read memory back off the device, and a way to run his own code on it.

The demonstrations are concrete. Against the Askey TCG3000 supplied by Orange Belgium, the exploit read the PSK from stored settings and used it to join the network. Against the Sagemcom BBOX3V+ supplied by Proximus, it opened a reverse shell carried over Wi-Fi frames, so no outside server was needed to receive the connection. Both ran with no login, and Kaiser says the attack works at a distance, not only within a few feet. He reports no real-world use; the working exploits are his own.

Scope

Broadcom’s WPS code ships in routers and access points from dozens of vendors, and Kaiser estimates millions of affected devices worldwide. He splits the vulnerable chips into two families. The older eCos-based models (BCM3380, BCM3383, BCM33834) have no usable fix, which is why he calls the bug a forever day, a flaw that will never be patched on those devices. The newer Linux-based models (BCM3390, BCM65xx, BCM68xx) could be fixed if their makers switch Wi-Fi software.

In Belgium he confirmed the flaw present and exploitable on gateways from three of the four big providers: Proximus, Orange Belgium, and VOO. He could not test a Telenet device, which may also be affected. His per-provider counts run into the hundreds of thousands of gateways, which he flags as rough estimates. A wider list he published reaches from Cisco small-business access points to Huawei and ARRIS routers, mixing confirmed entries with ones that rest only on an automated check flagging a device as “likely vulnerable.”

Why there’s no CVE

The code is old. Kaiser traces it to at least 2010. Broadcom shipped an incomplete fix in 2018, then advised customers to move to hostapd, a different Wi-Fi software package, rather than rely on that fix. On the eCos chips, he says, no working fix was ever shipped.

The reason this stayed quiet is the CVE process. Kaiser says Broadcom has known about the bug since 2018, had heard about it from others, and would neither register a CVE nor say anything publicly. He believes that silence is why so many device makers never patched: without a tracking identifier, there was nothing for them to follow. When he escalated to the CERT Coordination Center, the case was closed the same day, because Broadcom itself holds the authority to assign CVEs for its own products and declined to do so. The Hacker News found no CVE as of October 19.

This matters if you run this gear. The vulnerability management workflow most teams rely on, watch the feeds, match CVEs to an asset inventory, patch on a schedule, has no input here. A flaw this old and this serious generated no record to match against.

What you can actually do

There is no patch to install and no setting Kaiser points to that blocks the attack over the air. What he provides is detection: YARA rules that spot the vulnerable code in extracted firmware, and a script that listens to a live access point and reports whether it looks vulnerable. Both are triage aids. A patched device can still match the rules, so a hit means check further, not confirmed vulnerable.

For the eCos devices that will never be fixed, replacement is the only real option. For the Linux-based chips, the fix depends on the device maker switching to hostapd, so pressure and timelines belong with whoever supplies the hardware, which for ISP gateways is the provider, not the subscriber.

Kaiser notes the bug suits an attacker who reaches a target over nearby Wi-Fi rather than over the internet, the same approach Russian state hackers have used to break into networks from across the street.