Broadcom WPS Flaw Enables Unauthenticated Remote Root Access

A vulnerability in Broadcom’s Wi-Fi Protected Setup implementation enables attackers within radio range to execute code as root on affected routers without credentials or authentication. Researcher Quentin Kaiser disclosed the flaw on October 16 after demonstrating working exploits against gateways from Orange Belgium, Proximus, and VOO. The devices allowed attackers to extract stored Wi-Fi passwords or establish remote shells via Wi-Fi frames. No CVE has been assigned and no patches have been deployed.

The bug stems from improper handling of fragmented WPS messages that corrupt router memory, permitting memory access and arbitrary code execution. Vulnerable devices span two chip families: older eCos-based models (BCM3380, BCM3383, BCM33834) that cannot be fixed, and newer Linux-based variants (BCM3390, BCM65xx, BCM68xx) that vendors could address by switching Wi-Fi software. Broadcom has known about the flaw since at least 2010 and distributed an incomplete patch in 2018, directing customers to use alternative software rather than properly addressing the code.

Broadcom has refused to assign a CVE or make public statements about the vulnerability since learning of it in 2018, which Kaiser believes discouraged vendor remediation. Defenders lack patches or configuration mitigations, making device replacement the only practical option for equipment that will never be fixed. Kaiser released YARA detection rules and a scanning script to identify affected devices, though both function as triage tools flagging equipment requiring further verification.