A serious security flaw in Broadcom’s Wi-Fi setup software could allow attackers nearby to take complete control of vulnerable routers. Security researcher Quentin Kaiser disclosed the issue on October 16, 2026, explaining that attackers can exploit it without knowing the Wi-Fi password or completing the normal connection process. The vulnerability affects Broadcom-based routers and wireless access points, potentially exposing millions of devices worldwide.
The flaw exists in Broadcom’s implementation of Wi-Fi Protected Setup (WPS), a feature designed to make connecting devices to wireless networks easier. The software fails to correctly handle fragmented WPS setup messages, allowing attackers within wireless range to send specially crafted messages that corrupt the router’s memory. This can enable them to read sensitive information or execute their own code with root privileges, giving them extensive control over the affected device.
During testing, Kaiser demonstrated working attacks against routers provided by Belgian internet service providers. On an Orange Belgium gateway, the ASKEY TCG3000, he extracted the stored Wi-Fi password and transmitted it over the wireless connection. On a Proximus gateway, the Sagemcom BBOX3V+, he demonstrated how an attacker could open a remote command shell through Wi-Fi frames without requiring an external command server. Both attacks worked without authentication.
The vulnerability affects multiple Broadcom chipset families, including the older BCM3380, BCM3383 and BCM33834, as well as newer BCM3390, BCM65xx and BCM68xx platforms. The researcher found the issue on gateways associated with Proximus, Orange Belgium and VOO. Telenet devices may also be affected, although he could not test them. Broadcom’s Wi-Fi software is used by numerous manufacturers, but not every device on the published lists has been confirmed vulnerable.
Another major concern is the lack of a complete security fix. According to Kaiser, the vulnerable code dates back to at least 2010, and Broadcom released an incomplete fix in 2018 before recommending a move to alternative Wi-Fi software. Older eCos-based platforms reportedly have no effective fix, while newer Linux-based platforms may be secured if manufacturers migrate to different software. As of October 19, 2026, no CVE identifier had been assigned to the flaw.
For now, users should check with their internet service providers or router manufacturers for security updates and information about affected models. Kaiser has also released detection tools that can help security teams identify potentially vulnerable firmware, although a detection result does not always confirm that a device is exploitable. Replacing devices that cannot be secured may be necessary. The researcher reported no confirmed real-world attacks exploiting this particular flaw at the time of disclosure.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
