Your Wi-Fi password may not matter. A security researcher has shown that a flaw buried in Broadcom's Wi-Fi software since at least 2010 lets an attacker sitting within wireless range — in a parked car, a neighboring apartment, across the street — run their own code on vulnerable routers without knowing the network password, without connecting the normal way, and without the owner doing anything at all. In one live demonstration, the researcher pulled the saved Wi-Fi password straight out of a router's memory and sent it back over the air. In another, he opened a remote command shell on an internet provider's gateway. The disclosure landed on October 16 at the Hexacon conference in Paris, and by October 19 security outlets including SecurityAffairs and CybersecurityNews were warning that the affected chips sit inside products from dozens of vendors — with millions of devices worldwide potentially exposed, and, for many of them, no patch coming at all.
The researcher is Quentin Kaiser, and his timing is part of the story. He reported the bugs to Broadcom in July 2026. A disclosure deadline passed on October 15 — and, by his account, not one of the affected devices he examined in Belgium had been patched by then. Broadcom declined to assign the flaw a CVE number, the standard identifier that lets users and providers track a vulnerability, and directed him to contact device manufacturers instead. That means there is no tidy official list of affected models for most households to check — which is exactly why this story deserves your attention even if your router has never given you trouble.
Key Takeaways
- Researcher Quentin Kaiser disclosed the flaw at Hexacon in Paris on October 16, 2026: a bug in Broadcom's Wi-Fi Protected Setup (WPS) code, present in Broadcom's software development kit since at least 2010.
- An attacker within Wi-Fi range can trigger it without the network password and without any action from the owner, gaining information disclosure and arbitrary code execution on the router.
- Affected chip families include BCM3380, BCM3383 and BCM33834 on eCos-based devices, and BCM3390, BCM65xx and BCM68xx on Linux-based devices — silicon used by dozens of vendors in hundreds of products.
- Broadcom quietly released an incomplete patch in 2018 and later recommended makers move to different software instead; Kaiser calls the bug a definitive "forever day" on the eCos platforms, meaning many older gateways may never be fixed.
- Broadcom declined to assign a CVE, so there is no complete public affected-models list; in Belgium alone, the researcher estimates more than 1.5 million gateways are exposed.
How an Attack Works Without Your Password
The flaw sits in the code that handles WPS — the push-button or PIN system meant to make joining a network easy. Specifically, it is in how Broadcom's software reassembles fragmented EAP messages during that setup process. Weak length checks let a carefully crafted wireless message overflow a memory buffer, corrupt the router's memory, and redirect what the device does next. The result, in Kaiser's words, is controlled information disclosure and arbitrary code execution, triggered remotely over Wi-Fi "without knowledge of the network key or completion of a normal WPS enrollment."
Two clarifications matter for US readers. First, this does not break WPA2 or WPA3 encryption — the attack slips in through WPS handling before normal password checks protect you, which is why a strong password alone cannot stop it. Second, the attacker must be physically within Wi-Fi range. This is not a hack launched from another continent; it is a neighbor-range attack — precisely the scenario apartment buildings, dense suburbs and anyone with street-facing Wi-Fi should take seriously.
What the Demonstrations Actually Showed
Kaiser did not stop at theory. He confirmed the attack on live hardware handed out by three Belgian internet providers. Against an Orange Belgium ASKEY TCG3000 gateway, he extracted the Wi-Fi password from the device's memory and transmitted it back over wireless frames, then joined the network with it. Against a Proximus BBOX 3V+ made by Sagemcom, he obtained a remote command shell over Wi-Fi frames — full control, no cable, no cloud server in between. The confirmed list also includes VOO's Netgear CG3100 and CG3700 and Technicolor TC7210 and CGA4233 gateways. Equipment from a fourth provider, Telenet, may be affected through Sagemcom F@st devices, but Kaiser could not obtain one to test, so that part remains unconfirmed — and this article treats it that way.
Belgium is the test case, not the boundary. The vulnerable code ships in Broadcom's SDK, which manufacturers build into products worldwide. Kaiser estimates exposure at more than 1.5 million gateways in Belgium alone, and describes the wider picture as dozens of vendors, hundreds of products and millions of access points globally. Those global figures are the researcher's estimates, not an audited count — but the chip list is concrete, and US households using gateways built on those Broadcom families, including familiar names like Netgear and Technicolor hardware, cannot assume they are unaffected. We saw a similar lesson this month when hackers broke into flagship phones with a single email at Pwn2Own: a trusted device is only as safe as the least-examined code inside it.
Why So Many Routers May Never Get a Patch
The most uncomfortable part of this story is not the bug — it is the history. Broadcom silently released a patch in 2018 that turned out to be incomplete, and later recommended that manufacturers migrate to a different software stack, hostapd, rather than fully fixing the existing code. For gateways built on the older eCos platform — the BCM3380, BCM3383 and BCM33834 families — Kaiser concludes the flaw is a definitive "forever day": a permanent, unpatched vulnerability unless the hardware is replaced. Linux-based devices on BCM3390, BCM65xx and BCM68xx chips could be fixed, but only if each individual manufacturer does the migration work — and as of the October 15 disclosure deadline, the Belgian devices examined had received nothing.
The missing CVE makes everything harder. Without a CVE and a coordinated vendor advisory, there is no single page where a US customer can type in a model number and get a yes-or-no answer. CERT/CC, the US-backed vulnerability coordination center, opened and then closed a case after Broadcom declined to assign one. Kaiser is releasing a fingerprinting script and a detection rule so providers can map the exposure — useful for the industry, but cold comfort for a household that just wants to know about the box blinking in its hallway.
What US Households Should Do Now
There is no guaranteed one-click fix, and anyone who promises you one is selling something. What you can do is shrink the target and find out where you stand:
Router Safety Checklist
- Identify your box: check the label on your router or ISP gateway for the maker and model, then search the manufacturer's support site for October 2026 security notices about Broadcom or WPS.
- Turn WPS off: if your router's settings or app offers a WPS disable option, switch it off — the flaw lives in WPS message handling, and most homes never use WPS.
- Update the firmware: install any pending router firmware update from the manufacturer or your provider's official app, and enable automatic updates if offered.
- Ask your provider directly: if your gateway came from your cable or fiber company, ask them — through the number on your bill, not a number from a pop-up — whether your model uses the affected Broadcom chips and what their fix or swap plan is.
- Retire end-of-life hardware: a gateway the maker no longer updates cannot be made safe by settings alone; replacing it, or putting your own updated router behind it, is the durable fix.
- Keep your strong password: it still protects you against ordinary guessing and freeloading — this flaw is an exception, not a reason to give up on basics.
One more habit is worth building while you are thinking about home-network security: keep the documents you would need after any account or device problem — ID scans, bills, router and account paperwork — somewhere private on your phone rather than loose in a shared gallery. Pro Calculator Secure Vault stores photos, videos, audio, documents and private notes locally on your device with sign-in protection, an intruder selfie and an incognito private browser, and no data collected or shared with third parties.
Scam Warning: Fake "Router Fix" Messages Are Coming
Every widely reported router flaw is followed by the same second wave: emails, texts and calls claiming to be from your internet provider, offering an urgent "security patch," a free replacement gateway, or a refund — if you just confirm your password, card details or a small "processing fee." Treat all of it as hostile. Providers do not charge for security fixes, do not ask for your account password by text, and do not push patches through links in unsolicited messages. If a message worries you, ignore its links, open your provider's official app or type its real address yourself, and check there. Likewise, be wary of search ads and pop-ups offering a paid "Broadcom vulnerability scan" for home users — no such official consumer scan exists, and the fingerprinting tools Kaiser released are for providers and researchers, not a $49 download for your laptop.
Frequently Asked Questions
Is my router definitely affected?
Nobody can tell you that from a headline — including this one. The confirmed cases are specific Belgian provider gateways built on the listed Broadcom chips, and there is no CVE or complete public model list. If your router or ISP gateway uses Broadcom's BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx or BCM68xx families, treat it as potentially affected until the manufacturer or your provider says otherwise, and follow the checklist above.
Does changing my Wi-Fi password protect me?
Not against this specific flaw. The attack abuses WPS message handling and can run before your password protects the connection — in the demonstration, the password itself was read out of the router's memory. Keep a strong, unique password anyway: it still blocks the far more common attacks and casual freeloaders.
Why is there no patch after all these years?
By the researcher's account, Broadcom's 2018 patch was incomplete, and the company later advised manufacturers to move to a different software stack instead of completing the fix. On the older eCos-based gateways, that likely means no fix is coming at all; on Linux-based models, each manufacturer has to do its own migration work, and the devices checked by the October 15, 2026 disclosure deadline had not received it.
Should I buy a new router today?
Not in a panic. First check your model, apply any firmware update, disable WPS and ask your provider about its plan — many households will be covered by a provider swap program if their gateway is confirmed affected. Replacement makes the most sense if your hardware is already end-of-life and no longer receiving any updates at all; in that case you were exposed to more than this one bug.
The Bottom Line
A sixteen-year-old bug in the world's most common router silicon is a strange kind of news: the flaw is old, the code is everywhere, and the fix, for millions of gateways, may never arrive. Kaiser did the responsible-disclosure work — a July report to Broadcom, a deadline, a public demonstration — and the system answered with no CVE and no coordinated list. Until manufacturers publish clear model-by-model answers, the honest position for US households is the checklist above: know your box, kill WPS, update what can be updated, ask your provider, and replace hardware nobody maintains anymore. And while you are tightening up at home, give your phone the same treatment: Pro Calculator Secure Vault keeps your private photos, videos, documents and notes behind sign-in protection with local on-device storage, alongside 8 smart calculators (standard, floating, BMI, age, currency, tip, GST & VAT, loan EMI). You can see the maker's other apps on the ZAS developer page on Google Play.
No comments:
Post a Comment