By Hamza Faisal
A security researcher has disclosed a serious vulnerability in Broadcom's Wi-Fi software that has been sitting in routers for more than a decade and a half — and on the oldest affected chips, it can never be fixed.
Researcher Quentin Kaiser revealed the flaw, which he calls WPSplinter, in a talk at the Hexacon conference in Paris on October 16 and a detailed technical write-up published the same day. The bug lives in Broadcom's proprietary 802.11 implementation and has been present in the company's software development kit since at least 2010. It lets an attacker within Wi-Fi range execute commands and take over a router without knowing the network password, completing the normal setup process, or doing anything the user would notice.
A takeover from across the street
The vulnerability is in the code that handles WPS — the feature that lets devices join a wireless network without typing its key. A buffer overflow in the WPS EAP reassembly code allows memory corruption, information disclosure, and arbitrary code execution over the air, all without authentication.
In his demonstration, Kaiser extracted the Wi-Fi password from a router's memory over the wireless connection and used it to join the network. He also established reverse shells — full remote control — on routers from Orange Belgium (an ASKEY TCG3000) and Proximus (a Sagemcom F@st/BBOX3V+). Three of Belgium's four largest internet providers were found to ship vulnerable gateways, and as of October 15, not a single one had been patched.
The researcher estimates that over 1.5 million gateways are exposed in Belgium alone, with millions more Broadcom-based access points affected worldwide across dozens of vendors and hundreds of products. He has released a fingerprinting script and a YARA rule to help map the true blast radius, and has seen no evidence of real-world attacks so far.
A flaw that can never be fixed — and one that might
The affected chips fall into two families. Older eCos-based platforms (the BCM3380, BCM3383, and BCM33834) have no usable fix and never will — Kaiser calls the bug a permanent "forever day" there. Newer Linux-based models (the BCM3390, BCM65xx, and BCM68xx) could be remediated if their makers migrate their Wi-Fi software to hostapd, the open-source alternative.
That migration advice is not new. Broadcom silently shipped an incomplete fix back in 2018 and then recommended that customers move to hostapd instead of relying on the patch. According to Kaiser's account, the company has known about the bug since 2018 and had heard about it from other external researchers as well — yet declined to assign it a CVE identifier or communicate publicly about it, a silence he believes is the reason so many device makers never patched. When he reported the bugs again in July 2026, Broadcom again declined a CVE, and the CERT Coordination Center closed its case the same day.
What router owners should do
There is no consumer-side fix for devices running the vulnerable eCos firmware — the only real remedy is replacing the hardware. For newer models, owners depend on their internet providers and device makers to adopt the hostapd migration Broadcom has recommended.
The episode is a reminder that some of the most critical software in the home network ships inside black-box firmware that cannot be independently audited or updated — and that a bug planted in a chipmaker's development kit in 2010 can still open millions of front doors in 2026.
By Hamza Faisal
