Critical Broadcom Wi-Fi Flaw Enables Router Takeover Without Password

Critical Broadcom WPSplinter Flaw Disclosed by Security Researcher

Cybersecurity researcher Quentin Kaiser publicly revealed a critical vulnerability in Broadcom wireless networking chipsets that permits unauthorized remote code execution. Proof-of-concept demonstrations successfully extracted active wireless credentials from an Orange Belgium gateway and spawned an interactive command shell on a Proximus router. The technical research, formally released on October 16, underscores significant security exposure across consumer routers integrating Broadcom proprietary software. The vulnerability has been tracked across global cybersecurity communities under the identifier WPSplinter.

Exploiting the flaw over 802.11 frames enables an attacker to leak the Wi-Fi pre-shared key from NVRAM and join the local network.

Broadcom refused to register a CVE identifier for the WPSplinter vulnerability or publicly issue an advisory to affected equipment manufacturers.

Pre-Authentication Memory Corruption via Fragmented Setup Packets

The technical security flaw targets Broadcom's legacy software implementation of Wi-Fi Protected Setup protocols. In a presentation at the Hexacon security conference, the researcher demonstrated that malformed fragmented WPS messages trigger fatal buffer memory corruption. The severe architectural consequence is that affected routers execute hostile network packets before an intruder completes device authentication or inputs a password. Because memory corruption occurs during initial handshakes, rotating or strengthening wireless Wi-Fi passwords provides zero defense against local radio exploitation. The practical penetration testing demonstration against Orange Belgium successfully targeted the commercial Askey TCG3000 wireless broadband gateway.

Security disclosures submitted to Broadcom identified the flaw as a WPS EAP message reassembly buffer overflow.

Disconnect Between Upstream Patches and Deployed ISP Hardware

Correspondence released by the researcher indicated that semiconductor manufacturer Broadcom offered vendor customers patched software releases several years ago. Broadcom leadership designated the legacy WPS Monitor daemon as obsolete, shifting modern reference designs toward HostAPD and WPA Supplicant architectures. The chipmaker stated that its transition toward modern HostAPD and WPA Supplicant security software began as early as 2018. However, significant discrepancies persist between upstream semiconductor firmware availability and firmware updates deployed by commercial internet service providers. Audits of telecommunications gateways across Belgium and France revealed that numerous customer-premises devices remained unpatched on active networks. This supply-chain divergence leaves millions of subscriber households exposed despite available upstream vendor software corrections.

Testing demonstrated the vulnerability was present and exploitable on three Belgian Internet Service Providers including Proximus, VOO, and Orange gateways.

Risk Mitigation and Open-Source Firmware Auditing Tools

To assist enterprise network administrators, the researcher released open-source diagnostic utilities to evaluate hardware susceptibility. The released security toolkit provides specialized YARA detection rules for static firmware analysis alongside active over-the-air radio fingerprinting scripts. Because successful attack execution requires physical proximity within wireless radio range, remote internet-based exploitation remains effectively mitigated. Network defense teams are urged to conduct comprehensive hardware asset inventories to identify legacy router models requiring immediate firmware replacement. The disclosure underscores the critical importance of coordinated supply-chain vulnerability patching between silicon manufacturers, equipment makers, and broadband carriers.