No CVE has been assigned to the flaw, and no fix has been deployed to the affected routers, Kaiser says.
Quentin Kaiser’s disclosure and the demonstrations he showed
Security researcher Quentin Kaiser disclosed on October 16 a vulnerability in Broadcom's Wi‑Fi Protected Setup (WPS) implementation that, he says, allows an attacker within radio range to run code as root on Broadcom‑based routers without knowing the network password or performing any pairing step. Kaiser demonstrated exploits against home gateways supplied by three Belgian internet providers: an Askey TCG3000 (Orange Belgium) and a Sagemcom BBOX3V+ (Proximus), and reported additional findings on a VOO gateway.
Against the Askey TCG3000, Kaiser read the Wi‑Fi pre‑shared key (PSK) from the router's stored settings and sent it back over the air, then joined the network with it. Against the Sagemcom BBOX3V+, the exploit opened a reverse shell — a remote command line carried over Wi‑Fi frames — so no outside server was needed. Kaiser reports he has seen no real‑world attacks using the flaw; the working exploits are his own.
What the flaw is and which chips are affected
The fault lies in Broadcom's WPS code: it mishandles reassembly of fragmented WPS setup messages so that crafted messages can corrupt router memory. From that corruption, Kaiser developed two capabilities: read memory from the device and execute arbitrary code on it as root. He estimates that millions of devices worldwide contain the vulnerable code.
Kaiser identifies two families of vulnerable Broadcom chips. Older eCos‑based models — the BCM3380, BCM3383 and BCM33834 — lack a usable fix and are labeled by him a permanent "forever day." Newer Linux‑based models — the BCM3390, BCM65xx and BCM68xx — could be fixed if device makers switch their Wi‑Fi software. His public list mixes confirmed and unconfirmed entries, and some checks rely on an automated test that flags devices as "likely vulnerable."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleExploitable devices and the Belgian gateways Kaiser tested
In Belgium, Kaiser found the flaw present and exploitable on gateways from three of the four major providers: Proximus, Orange Belgium and VOO; a fourth, Telenet, may be affected but he could not test one. He estimates per‑provider counts running into the hundreds of thousands of gateways, calling those figures rough estimates. Broader entries on his list include Cisco small‑business access points, Huawei and ARRIS routers — mixing confirmed and likely cases.
Why there is no patch and why no CVE exists
Kaiser traces the vulnerable code back to at least 2010. He says Broadcom shipped an incomplete fix in 2018 and advised customers to switch to a different Wi‑Fi software package, hostapd, rather than rely on Broadcom's patch. For the older eCos devices, Kaiser says no working fix was ever shipped.
Broadcom, Kaiser says, told him it has known about the bug since 2018, had heard about it from others, but would not register a CVE or make a public statement. When Kaiser brought the case to the CERT Coordination Center, it was closed the same day because Broadcom itself holds the authority to assign CVEs for its products and would not do so. The Hacker News found no CVE for the flaw as of October 19.
Defensive artifacts Kaiser published and practical options
There is no patch to install and Kaiser points to no device setting that blocks the attack over the air. To help defenders, he published YARA rules that identify the vulnerable code in extracted firmware and a script that listens to a live access point and reports whether it appears vulnerable. He notes both are triage aids: a patched device can still match the rules, so a hit requires further checking. For gear he deems unfixable, replacement is the practical option.
What this means for technologists, regulators, and consumers
- Technologists and security teams: Use Kaiser’s YARA rules and live‑AP script to triage deployed Broadcom‑based equipment, prioritize replacement of eCos‑based devices (BCM3380/3383/33834) that Kaiser calls a "forever day," and consider vendor guidance about switching Wi‑Fi stacks where available.
- Regulators and coordinators: The CERT Coordination Center closed the case after Broadcom declined to assign a CVE; that procedural detail is now central to whether the vulnerability is tracked publicly and whether downstream vendors treat it as actionable.
- Consumers and subscribers of affected providers: Devices supplied by Proximus, Orange Belgium and VOO were shown exploitable in Kaiser’s tests; the attack works at a distance, requires no login and can reveal a router's PSK or give a remote shell, so replacement or vendor guidance will be the main remedies where no fix is forthcoming.
Kaiser frames the bug as "well suited to attackers who reach a target over nearby Wi‑Fi rather than the internet, a technique Russian state hackers have used to breach networks from across the street." Without a broadly published CVE or a vendor‑distributed patch for many devices, his work leaves a factual question in plain sight: will Broadcom register the flaw and will vendors switch to a fixed Wi‑Fi stack or push replacements? Until that happens, millions of Broadcom‑based access points and routers remain candidates for local wireless exploitation, and replacement is the fallback for devices Kaiser calls unpatchable.
