Broadcom SDK WPS Flaw Enables Unauthenticated RCE on Routers Without Password

Security researcher Quentin Kaiser disclosed a vulnerability in Broadcom's Wi-Fi SDK that allows attackers to execute code on routers without authentication. The flaw, present since 2010, affects Wi-Fi Protected Setup handling and has been demonstrated on multiple Belgian ISP gateways.

What happened

Kaiser presented findings at Hexacon in Paris on October 16, 2026, detailing a bug in Broadcom’s proprietary 802.11 implementation. The vulnerability resides in the code that reassembles fragmented WPS messages, allowing crafted wireless frames to corrupt memory. Attackers within Wi-Fi range can exploit this without knowing the network password or completing WPS enrollment. This results in controlled information disclosure and arbitrary code execution on the device.

The researcher demonstrated the exploit against an Orange Belgium ASKEY TCG3000 router, extracting the Wi-Fi password from memory and sending it back over the air. He then used the stolen credentials to join the network. Against a Proximus Sagemcom BBOX3V+ gateway, Kaiser opened a reverse shell over Wi-Fi frames, requiring no external command server. Both attacks occurred without any user interaction or authentication.

Kaiser identified the flaw on devices from three major Belgian providers: Proximus, Orange Belgium, and VOO. He estimates roughly 1.56 million gateways in Belgium are affected, with millions more potentially vulnerable worldwide. As of October 15, 2026, none of the tested Belgian devices had received a patch, according to Security Affairs.

Why it matters

The vulnerability affects two families of Broadcom chips: older eCos-based models (BCM3380, BCM3383, BCM33834) and newer Linux-based ones (BCM3390, BCM65xx, BCM68xx). Kaiser states the bug is a "forever day" for eCos platforms because no usable fix exists and Broadcom recommended migrating to hostapd. Linux platforms could be fixed if original equipment manufacturers migrate their software, but many have not done so.

This is not a theoretical risk. Kaiser built working exploits that run as root, bypassing all authentication. The attack works at a distance, not just in close proximity. Because the flaw is in the SDK, it affects dozens of vendors, including Cisco, Huawei, and ARRIS. No CVE has been assigned, and no vendor has released a confirmed fix for the affected devices.

What to watch

• Monitor Broadcom and OEM advisories for any migration guides to hostapd or other Wi-Fi stacks.
• Watch for confirmed patches from ISPs, particularly in Belgium where exploitation was demonstrated.
• Track whether any real-world attacks begin leveraging this unauthenticated remote code execution flaw.
• Observe if other vendors beyond the Belgian ISPs acknowledge affected inventory in their fleets.

Who needs to act first

Teams managing enterprise or consumer gateways should immediately inventory devices using Broadcom Wi-Fi chips, focusing on those still running legacy firmware. Prioritize systems exposed to untrusted wireless environments, as the attack requires only proximity. If a patch is unavailable, consider isolating these devices on separate VLANs or disabling WPS entirely if the firmware allows it. Test any migration to alternative Wi-Fi stacks in a lab environment before rolling out to production. Ensure that remote management interfaces are restricted to known IP ranges to limit exposure while awaiting vendor updates.

What to do and how to stay safe: Broadcom

• Disable Wi-Fi Protected Setup (WPS) on all routers and access points if the configuration interface permits it.
• Verify whether your devices use Broadcom chips listed as affected and check with your ISP for patch status.
• Restrict wireless access to authorized personnel and use strong network segmentation to limit lateral movement.
• Once the vendor provides an update, apply it immediately and verify that WPS functionality is no longer vulnerable.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a CVE for this Broadcom Wi-Fi flaw?

No CVE has been assigned to the flaw, according to Quentin Kaiser.

Can I fix this by changing my Wi-Fi password?

No, the attack does not require the Wi-Fi password and bypasses normal authentication entirely.

Which routers are definitely affected?

Confirmed affected devices include Orange Belgium ASKEY TCG3000, Proximus Sagemcom BBOX3V+, and VOO Netgear CG3100 and CG3700.