Last updated: October 20, 2026
The quick answer
Security researcher Quentin Kaiser has disclosed a bug in Broadcom’s Wi-Fi Protected Setup (WPS) code that lets someone within Wi-Fi range take full control of some routers and cable gateways without knowing the Wi-Fi password. Affected devices have not been patched and some may never be, so the practical steps are to ask your internet provider about a firmware fix, turn off WPS as a precaution, and plan to replace old, unsupported hardware.
What happened
On October 16, 2026, Kaiser published research on a memory-corruption bug in the way Broadcom’s software reassembles fragmented WPS setup messages. WPS is the feature behind the “push the button to connect” option on many routers. The flawed code dates back to at least 2010 and ships inside Wi-Fi equipment from many brands that use Broadcom chips. The research has been dubbed “WPSplinter.”
Kaiser demonstrated working attacks against two internet-provider gateways used in Belgium. In one, his code pulled the stored Wi-Fi password out of the device’s memory and sent it back over the air, letting him join the network. In the other, he opened a remote command shell carried entirely over Wi-Fi frames. The Hacker News, Cybernews and Techzine all reported that no password, pairing step or login was needed, and that the attack is not limited to very short distances.
According to the researcher, Broadcom has known about the bug since 2018, shipped an incomplete fix and advised customers to move to different Wi-Fi software, but declined to assign a CVE identifier or issue a public advisory. Kaiser believes that silence is why many device makers never patched. As of October 15, none of the affected devices he examined had received an update. He also reports no attacks seen in the wild so far; the exploits are his own.
| Broadcom platform | Chip families named | Fix outlook |
|---|---|---|
| Older eCos-based gateways | BCM3380, BCM3383, BCM33834 | No usable fix identified; the researcher calls it a “forever day” |
| Newer Linux-based devices | BCM3390, BCM65xx, BCM68xx families | Fixable if device makers update their Wi-Fi software |
What changes for you
A router is the front door to every device in your home. If someone takes it over, they can learn your Wi-Fi password, join your network and potentially watch or redirect traffic from phones, laptops and smart devices. The attacker does need to be within radio range, which makes this most relevant in apartment buildings, shared offices, dorms and hotels, where strangers are often close by.
The uncomfortable part is that you can’t fix this yourself with a setting. Reports differ on whether switching off WPS blocks the attack: Techzine lists it as a mitigation, while Cybernews notes it may not remove the risk, and the researcher’s write-up doesn’t say. Treat turning it off as sensible hygiene rather than a guaranteed cure.
What to do now
- Find out what router you have. Check the label on the bottom or back for the brand and model. If your internet provider supplied it, note that too.
- Turn off WPS. Log in to your router’s admin page or app and disable WPS (sometimes listed as “WPS PIN” or “push-button connect”). Few people need it, and it has a long history of security problems.
- Ask your provider directly. If your gateway came from your ISP, contact them and ask whether your model uses an affected Broadcom chip and when a firmware update is coming. Providers usually push updates to rented gateways themselves.
- Check for firmware updates on routers you bought yourself, and enable automatic updates if the option exists.
- Plan a replacement for old hardware. If your router no longer receives updates, swapping it for a current, supported model is the only reliable fix. If you rent from an ISP, ask for a newer unit.
- Change your Wi-Fi password after any fix, since a vulnerable device could already have leaked it, and keep your devices’ own updates current so they’re harder to attack if someone does get onto your network.
Technically minded readers can use the fingerprinting script and detection rules Kaiser published on GitHub. He describes them as triage aids: a match is a reason to look closer, not proof a device is vulnerable.
Who is affected, and who isn’t
Most likely affected: customers using older cable gateways and routers built on the Broadcom chips listed above, especially ISP-supplied units. Kaiser confirmed the problem on gateways from Belgian providers Proximus, Orange Belgium and VOO, and roughly estimates about 1.5 million affected gateways in Belgium alone. Reported vulnerable models elsewhere include several older Movistar-supplied routers in Spain and the ZTE F680 V4. Reports also list equipment from brands such as Netgear, Technicolor, Sagemcom, Askey, ARRIS and Huawei, though the wider list mixes confirmed and “likely vulnerable” entries.
Less likely affected: routers that don’t use Broadcom Wi-Fi chips, and newer devices whose makers already switched away from the old Broadcom WPS code. Kaiser estimates millions of devices worldwide are exposed, but no complete global list exists, so checking with your provider is the most reliable route. If you also run a media server at home, see our guide to the Plex2Shell attacks on older Plex servers.
FAQ
Is anyone actually using this attack?
Not that anyone has reported. The researcher says the demonstrated exploits are his own, but now that the details are public, the risk of copycats rises over time.
Will changing my Wi-Fi password protect me?
Not on its own. The attack doesn’t need your password, and in one demonstration it extracted the password from the router. Change it after the device is patched or replaced.
Does this have a CVE number?
No. Broadcom controls CVE assignment for its products and declined to issue one, so you won’t find it in the usual vulnerability databases.
Sources
- Quentin Kaiser: One Parser, Two Bugs, Many Routers
- The Hacker News: Unpatched Broadcom Wi-Fi flaw lets attackers in range run code as root on routers
- Cybernews: Broadcom chip flaw lets nearby hackers take over millions of routers
- Techzine: Broadcom WPSplinter vulnerability leaves millions of Belgian routers vulnerable
Leave a Reply