Broadcom Wi-Fi Flaw Enables Unauthenticated Remote Code Execution on Routers
A vulnerability in Broadcom’s 802.11 implementation dating back to 2010 allows attackers to execute code on routers without authentication or Wi-Fi credentials.
Key points
- Researcher Quentin Kaiser documented the flaw in Broadcom’s proprietary 802.11 SDK at Hexacon in Paris.
- The bug affects eCos and Linux-based platforms, with no confirmed patches for some Belgian devices as of October 15, 2026.
- Exploitation requires only Wi-Fi range; no password, WPS completion, or user interaction is needed for code execution.
Researcher Quentin Kaiser revealed a persistent vulnerability in Broadcom’s Wi-Fi implementation that allows unauthenticated remote code execution on affected routers. This flaw has existed in the vendor’s SDK since at least 2010 and remains unpatched on several consumer devices.
What happened
Quentin Kaiser presented findings at Hexacon in Paris regarding a vulnerability in Broadcom’s proprietary 802.11 implementation, which has been present in their software development kit since at least 2010. The defect resides in the WPS EAP reassembly code, a component handling wireless setup processes on many consumer routers. According to Kaiser, an incomplete patch was silently released in 2018, but Broadcom subsequently recommended migrating to hostapd rather than fixing the legacy code.
This recommendation effectively makes the vulnerability a permanent issue on eCos-based platforms, including the BCM3380, BCM3383, and BCM33834 chipsets. On Linux platforms such as the BCM3390, BCM65xx, and BCM68xx series, the flaw remains a potential permanent risk unless original equipment manufacturers choose to migrate their firmware away from the affected implementation.
Why it matters
The vulnerability allows attackers within Wi-Fi range to trigger the bug without knowing the network key or completing normal WPS enrollment. Kaiser demonstrated working exploits against two specific devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. In these tests, the attacker achieved arbitrary code execution and controlled information disclosure. As of October 15, 2026, none of the affected devices in Belgium had received a patch, according to Security Affairs. The demonstration showed that an attacker could extract the Wi-Fi password from the router’s memory and transmit it over the wireless connection.
Our take on the response
- Verify if your network infrastructure uses Broadcom chipsets listed in the report.
- Check firmware versions for the ASKEY TCG3000 and Sagemcom F@st/BBOX3V+ devices.
- Monitor for unauthenticated traffic patterns consistent with WPS reassembly exploitation.
- Plan for migration to hostapd-based implementations if currently using vulnerable eCos or Linux kernels.
What defenders should look for
Teams usually detect this type of activity by monitoring for anomalous WPS transaction spikes or unexpected memory access logs on wireless controllers. Check whether routers are initiating reverse shell connections or transmitting large data blocks without corresponding user activity. Look for authentication bypass attempts in firewall logs that do not involve standard credential submission. Containment moves typically involve isolating affected segments at the switch level and disabling WPS services on vulnerable access points until firmware updates are available.
What to do and how to stay safe: Broadcom
- Audit your inventory for Broadcom BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx, and BCM68xx chipsets.
- Disable WPS on all consumer routers to eliminate the attack surface for this specific reassembly flaw.
- Monitor network traffic for unexpected reverse shell connections originating from router IPs.
- Wait for vendor updates; once the vendor provides an update, apply it immediately to affected devices.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific chipsets are affected by this Broadcom vulnerability?
The eCos-based platforms BCM3380, BCM3383, and BCM33834 are definitively affected, while Linux platforms BCM3390, BCM65xx, and BCM68xx are potentially affected unless migrated.
Do attackers need the Wi-Fi password to exploit this flaw?
No, the vulnerability allows exploitation without knowledge of the network key or completion of normal WPS enrollment.
Has a patch been released for this vulnerability?
An incomplete patch was released in 2018, but Broadcom recommended migrating to hostapd instead, leaving many devices unpatched as of October 2026.
