A 16-year-old Broadcom Wi-Fi flaw can let nearby attackers take over routers

A flaw in Broadcom’s legacy WPS Monitor software can let an attacker within radio range take control of a vulnerable router without a password. Security researcher Quentin Kaiser presented the issue, which he calls “WPSplinter,” at Hexacon. No CVE has been assigned.

The flaw dates back to at least 2010. When WPS messages arrive in fragments, the software reassembles them without checking that the result fits the memory reserved for it. Kaiser’s documentation says attackers can reach the vulnerable code over Wi-Fi before pairing completes, potentially allowing them to read router memory and run code.

Kaiser demonstrated the issue on an Askey TCG3000 gateway supplied by Orange Belgium, retrieving its Wi-Fi password, and on a Sagemcom-built Proximus BBOX3V+, where he opened a remote shell over Wi-Fi frames. He says the attack works at long range but has not published a distance.

Kaiser reported the flaw to Broadcom in July 2026. He says Broadcom replied on July 28 that a patch was available and said it had known of the bug since 2018. Broadcom has issued no public advisory; its position is known through Kaiser’s account. Kaiser says the earlier patch was incomplete and that fixing affected Linux-based chips requires manufacturers to port newer software. Older eCos-based chips BCM3380, BCM3383 and BCM33834 have no migration path, he says.

A firmware update from an internet provider or router maker is the stated fix for supported devices. Kaiser warns that turning off WPS in settings may not disable the vulnerable parser. The source reports that users renting gateways should ask providers whether the legacy code remains in their firmware.