- Researcher Quentin Kaiser says a Broadcom Wi-Fi setup flaw lets an attacker in range run code on routers. He reports no CVE and no deployed fix.
- He showed it on gateways from three Belgian providers. He estimates millions of devices worldwide are affected, and says the counts are rough.
- Ask your providers for written patch status. Do not rely on CVE feeds alone to find this flaw.
Most security programs run on a simple loop. A flaw gets an identifier, scanners learn it, and a ticket lands with someone who can fix it. Remove the identifier and the loop has nothing to start from. That is the lesson in a router flaw that independent researcher Quentin Kaiser presented on October 16 at the Hexacon conference in Paris.
What Kaiser found
Kaiser says Broadcom's own implementation of Wi-Fi (the 802.11 standard) contains a flaw that an attacker in radio range can trigger. The attacker needs no network key and does not need to complete a normal Wi-Fi Protected Setup (WPS) enrollment. Kaiser says exploitation gives controlled information disclosure and arbitrary code execution. The Hacker News describes the result as code running as root, meaning full control of the device.
He demonstrated two attacks. On an Orange Belgium gateway, the Askey TCG3000, his exploit made the router give up its Wi-Fi key from internal storage and transmit it to him wirelessly. He then logged onto the network with that key. Kaiser says this showed the device stayed stable and the key was correct.
On a Proximus gateway, the BBOX3V+, the exploit gave him a command prompt on the router. That prompt was carried over Wi-Fi (802.11) frames. Kaiser notes this means no control server on the internet was required.
Kaiser says the attack works over long distances. The Hacker News reports that he knows of no real-world attacks and that the working exploits are his own.
How the attack works
WPS is a pairing shortcut for Wi-Fi. It exists so new gadgets can connect without the owner entering a password. Its setup messages can arrive in fragments, and the router must stitch them back together. Kaiser's report describes a "WPS EAP reassembly overflow". The Hacker News explains it this way: Broadcom's code mishandles that stitching step, so crafted messages corrupt the router's memory.
Kaiser turned that memory damage into two tools. One reads data out of the router. The other executes commands of his choosing. This happens before the attacker proves anything about who they are. That is why no password is needed.
Kaiser lists two chip families. Older eCos-based models (BCM3380, BCM3383, BCM33834) have no usable fix. He calls them a "forever day", meaning a flaw with no fix available. Newer Linux-based models (BCM3390, BCM65xx, BCM68xx) could be fixed if their makers move to a different Wi-Fi package, hostapd.
Sixteen years, and no identifier
Kaiser traces the vulnerable code to at least 2010. He says Broadcom released an incomplete patch in 2018 without announcement, then recommended hostapd instead.
His disclosure log shows the gap. He reported the flaw to Broadcom on July 18 and July 27. On July 28, Broadcom replied that a patch was available and told him to ask manufacturers to contact Broadcom. On July 29, he says, Broadcom refused to register a CVE. A CVE is the public tracking number that scanners and vendors use to follow a flaw.
On August 4 he opened a case with the CERT Coordination Center. It shut the case the same day. Broadcom can issue CVE numbers for its own products, and it had declined to do so. The Hacker News found no CVE as of October 19.
Kaiser believes this silence is probably why so many device makers did not patch. That is his judgment, not a proven cause. He says that as of October 15, none of the affected Belgian devices had been patched, after a 90-day disclosure window.
Who carries the risk
The chipmaker wrote the code. The provider supplies the router. The customer holds the device, but updates are usually pushed by the provider. Each party can point to another. This shows how supply chains spread responsibility until nobody owns the fix.
Kaiser says three of four large Belgian providers' gateways are affected: Proximus, Orange Belgium and VOO. Telenet may be, but he could not test one. He says the issue is not limited to Belgium, because the manufacturers serve a larger market. His wider device list mixes confirmed and unconfirmed entries. For some devices, the only evidence is an automated test that labels them "likely vulnerable" rather than confirmed.
The numbers are soft. Kaiser estimates millions of devices worldwide. He puts Belgian counts in the hundreds of thousands, per The Hacker News, and has medium confidence in his own estimates.
He also says AI changed the economics. By his account, research that would have taken months took less than a week with frontier models. That is one researcher's experience. It does suggest that old, deep code is cheaper to examine than it used to be.
Questions to put to your team
First, do we know which gateways our offices and remote staff rely on, and which chips are inside? Second, does our vendor-risk process depend on CVE feeds? If so, how would we learn of a flaw that has none?
Third, ask each provider for written patch status and a date. Kaiser says he has no information about measures providers are taking. Fourth, ask whether your security staff can use the tools Kaiser released. One is a set of YARA rules, which are pattern checks for scanning extracted firmware. The second is a small program that checks a running access point and reports whether it appears vulnerable. Kaiser cautions that both only help sort cases, and that a patched device can still match the rules.
A flaw without an identifier is not a smaller risk. It is a risk that nobody has been asked to count.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Quentin Kaiser (independent security researcher).
