A 16-year-old security flaw in Broadcom's Wi-Fi software could let attackers hijack millions of routers without knowing the network password, even though the chipmaker reportedly knew about the problem since 2018. Security researcher Quentin Kaiser disclosed the vulnerability, dubbed "WPSplinter," revealing two bugs in Broadcom's proprietary Wi-Fi implementation that date back to at least 2010. An attempted fix arrived eight years later, but Kaiser claims it didn't fully resolve the problem. The bugs lie in Broadcom's handling of Wi-Fi Protected Setup (WPS), the feature that lets users connect devices to a wireless network without manually entering a password. Kaiser found that specially crafted WPS messages could corrupt the router's memory, allowing someone within Wi-Fi range to run their own code on the device. They wouldn't need the Wi-Fi password, and the router's owner wouldn't have to do a thing. Kaiser demonstrated working exploits against routers supplied by Belgian internet providers Proximus and Orange. In one attack against an ASKEY TCG3000 gateway, he ran code on the device, pulled its Wi-Fi password from memory, and sent it back over the air. He then used the stolen credentials to join the network. He also found the flaw in Netgear and Technicolor routers supplied by VOO. He estimates that around 850,000 Proximus gateways could be affected, along with 500,000 at VOO and 210,000 at Orange Belgium. That puts the potential total at 1.56 million routers in Belgium alone, although Kaiser admits the figures are rough estimates. However, the problem is unlikely to stop at the Belgian border. Broadcom's Wi-Fi technology is used by dozens of manufacturers across hundreds of products, meaning the number of affected devices worldwide could be considerably higher. According to Kaiser, the chipmaker knew about the vulnerability back in 2018 and released a partial fix without publicly disclosing the problem. It subsequently recommended that manufacturers move away from its proprietary implementation and use the open-source hostapd software instead. Owners of routers running Broadcom's older eCos-based chips, including the BCM3380, BCM3383, and BCM33834, are in a particularly grim position. Kaiser calls the flaw a "forever day," meaning those devices may never get a fix. Routers using Linux-based BCM3390, BCM65xx, and BCM68xx chips aren't necessarily off the hook either, unless their manufacturers switch to hostapd. That leaves some older routers with no obvious route to a fix, while others depend on their manufacturers updating software that may be years out of support. Kaiser first reported the vulnerabilities to Broadcom on July 18, followed by a second report on July 27, giving the company and affected vendors 90 days before public disclosure. Broadcom responded on July 28 to say a patch was available and advised him to contact affected manufacturers directly. The following day, however, the company declined to assign a CVE identifier or provide him with a copy of the notification it said it had sent to manufacturers through its customer portal. Kaiser also contacted Proximus, attempted to reach Orange Belgium and VOO, and passed his findings to Belgium's national cybersecurity authorities. He subsequently opened a case with CERT/CC, which closed it on August 4 because Broadcom was itself a CVE Numbering Authority and had declined to register the vulnerability. By October 15, a day before his presentation, Kaiser said none of the affected devices he had identified had received a patch. Kaiser hasn't reported evidence of attacks in the wild, but the potential for mischief is considerable. Someone parked outside a home or office could potentially compromise a vulnerable router, steal network credentials, or use their access to interfere with traffic. Kaiser also credited AI with speeding up the investigation. He reckons the work would ordinarily have taken him months, but with the help of frontier models, he finished it in less than a week. ®
