Broadcom Wi‑Fi Flaw Lets Routers Hijacked Without Password

A bug in Broadcom’s 802.11 implementation, first seen in 2010, lets attackers in Wi‑Fi range execute code on affected routers without authentication. The flaw is in the WPS message reassembly code, which can be manipulated to corrupt memory and disclose information or run arbitrary code. Researchers demonstrated that an attacker does not need the network key or to complete a normal WPS setup to trigger the exploit.

How the Bug Works

In live tests, the researcher used an Orange Belgium ASKEY TCG3000 and a Proximus BBOX3V+ to pull the Wi‑Fi password from the router’s memory and then open a reverse shell over Wi‑Fi frames. The attacks worked without any action from the user and did not rely on a remote command‑and‑control server. Both devices ran code with root privileges, showing the full impact of the vulnerability.

Broadcom released an incomplete patch in 2018 and has since advised customers to switch to hostapd instead of shipping a complete fix for its own code. The company has not assigned a CVE identifier or issued a public advisory, and the CERT/CC case opened and closed on the same day. As a result, many affected devices remain unpatched as of mid‑October 2026.

Global Exposure and Mitigation

The researcher estimates that roughly 1.5 million routers in Belgium are affected, with 850,000 supplied by Proximus, 500,000 from VOO’s legacy fleet and 210,000 from Orange Belgium. Other brands such as Movistar, Cisco, TP‑Link, Netgear, Nokia and ZTE also use the vulnerable Broadcom chips, meaning millions of routers worldwide could be exposed.

Owners should check with their internet provider or manufacturer for firmware updates, and consider replacing unsupported routers if no fix is available. Disabling WPS does not eliminate the flaw, and the only reliable mitigation is to patch or replace the device. Users are advised to stay informed through their provider’s security notices and to monitor for any new information.