Broadcom Wi‑Fi flaw may affect millions of routers worldwide

The bug lives in Broadcom’s version of Wi-Fi Protected Setup, or WPS, the push-button feature that lets a gadget join your network without typing the password. When WPS setup messages arrive in pieces, Broadcom’s older software, called WPS Monitor, reassembles them without first making sure the finished message has enough room in memory, so it can spill over into space it should never touch.

An attacker in radio range can exploit that by sending specially shaped messages. Because this happens before any pairing finishes, no PIN, no button press and no network key are needed. Kaiser built two tools on top of the bug: one that reads data out of the router’s memory and one that runs his own code on it, with the highest level of control, known as root.

This is different from the WPS PIN guessing attacks of the early 2010s. Those abused a weakness in how WPS was designed. This one is a coding mistake in Broadcom’s software. Kaiser has nicknamed it WPSplinter, and with no official tracking number, that is the only name it has.

Kaiser disclosed the flaw on October 16 and presented it at the Hexacon security event. He tested it on gateways handed out by Belgian internet providers.

• On an Askey TCG3000 from Orange Belgium, his code pulled the stored Wi-Fi password, sent it back over the air, and he then used it to join the network.
• On a Proximus BBOX3V+, built by Sagemcom, he opened a remote command line that ran entirely over Wi-Fi signals, with no outside server needed.

He found the flaw present and usable on gateways from three of Belgium’s four big providers, Proximus, VOO and Orange Belgium. Telenet may be affected too, but he could not get one to test. The attack is not limited to close range, he says, although he has given no figure for how far it reaches, and he reports no attacks in the wild. The working exploits are his own.

The vulnerable hardware falls into two groups of Broadcom chips. Older chips running the eCos system, such as the BCM3383, BCM33834 and BCM3380, have no realistic fix at all. Kaiser calls this a forever day: on those devices, the hole stays open for good. Newer Linux-based chips, including the BCM68xx, BCM65xx and BCM3390 families, can be fixed, but only if each manufacturer does the work.

Kaiser also published a wider list of possibly affected products, from Huawei and ARRIS routers to Cisco access points for small businesses, but it mixes confirmed and unconfirmed models.

The patch story is messy. Kaiser reported the bug to Broadcom in July 2026. On July 28, Broadcom replied that a patch existed and told him to contact device makers. By his account, it said it had known about the issue since 2018 and had been replacing WPS Monitor with hostapd, a free open-source alternative, ever since. Kaiser says the 2018 fix to the old code was incomplete and quiet.

Broadcom also declined to request a CVE, the ID number defenders use to track a flaw, saying the software was obsolete and out of support. Because Broadcom is allowed to assign CVEs for its own products, that decision stuck: the CERT Coordination Center closed Kaiser’s case the same day he raised it. Kaiser believes the silence is why so many router makers never fixed it.

Here is the uncomfortable part. Because the attack happens before login, changing your Wi-Fi password does nothing. Switching off WPS in your router settings may not help either, since Kaiser warns that the toggle may not fully disable the faulty code. An internet provider turning off WPS centrally might, but it is unclear how many will.

That leaves three practical steps:

1. Check for firmware updates. Look on your router maker’s support site or in the router’s own admin page and install anything new.
2. Ask your provider. If you rent your gateway, contact your internet provider and ask whether its firmware still includes Broadcom’s old WPS code.
3. Replace hardware that will never be fixed. If your router is old and out of support, or uses one of the older eCos-based chips, a newer supported model is the only real cure.

Kaiser has also released tools that let technical users and network teams check firmware for the vulnerable code or listen to a live access point. He stresses they only flag likely problems, so a match means check further, not panic.