Millions of home and ISP routers remain exposed to an unpatched Broadcom Wi-Fi flaw that lets an attacker within radio range run code as root, and no CVE had been assigned as of October 19. Researcher Quentin Kaiser disclosed the issue on October 16 at the Hexacon conference in Paris.
Broadcom WPS EAP Fragment Reassembly Flaw Enables Unauthenticated Code Execution
Kaiser found the flaw in the WPS EAP fragment reassembly code of Broadcom’s proprietary 802.11 stack. An attacker in Wi-Fi range can corrupt router memory and gain unauthenticated remote code execution without the Wi-Fi password and without any pairing step.
Affected chips include the BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx and BCM68xx families. Kaiser confirmed vulnerable gateways from Belgian ISPs Proximus, Orange Belgium and VOO. Telenet devices may also be affected but were untested. His wider list, running from Cisco small-business access points to Huawei and ARRIS routers, mixes confirmed and “likely vulnerable” entries. He estimates millions of devices worldwide are affected, and Belgian per-provider counts run into the hundreds of thousands of gateways, by rough estimate.
Demonstrations Against Orange Belgium and Proximus Gateways
Kaiser demonstrated the attack on two consumer devices. Against an Orange Belgium Askey TCG3000, he read the Wi-Fi pre-shared key from memory, sent it over the air and joined the network. Against a Proximus Sagemcom BBOX3V+, he opened a reverse shell carried over Wi-Fi frames, with no outside server involved.
The attack works at a distance. The close antenna visible in his video was only a lab setup, according to Kaiser.
A Sixteen-Year-Old Bug With an Incomplete 2018 Fix
The vulnerable code dates to at least 2010. Broadcom shipped an incomplete fix in 2018 and told customers to move to hostapd, the open-source Wi-Fi access point software. Kaiser says Broadcom confirmed it has known about the problem since 2018.
The fixability depends on the hardware. On older eCos-based chips, there is no usable fix, which Kaiser describes as a “forever day.” On newer Linux-based chips a fix is possible if device makers switch their Wi-Fi software. As of October 15, none of the affected Belgian devices had received a patch.
Why No CVE Exists for the Broadcom WPS Vulnerability
Kaiser says Broadcom would not register a CVE or comment publicly. He then turned to CERT/CC, which closed his case the same day because Broadcom holds CVE-assignment authority for its own products. The result is a vulnerability affecting millions of devices with no identifier that scanners, asset inventories and vendor advisories can key on.
That gap matters operationally. Enterprise and ISP vulnerability programs generally track exposure by CVE number, so a flaw without one is easy to miss in patch reporting. The disclosure process in this case depended on the vendor holding assignment authority agreeing to register an identifier, and Broadcom declined.
Detection Tools and Practical Options for Defenders
No real-world attacks have been reported. There is also no patch to apply. Kaiser published YARA rules that can be run against extracted firmware, plus a script that listens to a live access point and flags likely vulnerability. Hits on the YARA triage rules are only a reason to investigate, not confirmation that a device is exploitable.
What Operators of Unfixable eCos Routers Can Do
For eCos gear with no usable fix, replacement is the practical option, according to the research. ISPs that deploy affected gateways to customers carry the most responsibility here, because home users cannot update proprietary firmware themselves. Where a Linux-based chip is involved, the remedy depends on whether the device maker ships updated Wi-Fi software.
The exposure is limited by physical proximity, since the attacker must be within Wi-Fi range. A root shell on a router would give an attacker a position from which to observe and redirect traffic for everyone behind it.
