Broadcom Wi-Fi flaw could let nearby attackers root routers

A newly disclosed Broadcom Wi-Fi flaw could let an attacker within radio range run code as root on some routers without knowing the network password. Security researcher Quentin Kaiser demonstrated the issue against gateways supplied by Belgian internet providers, while The Hacker News reports that no patch has been deployed for the affected routers it examined.¹²

What the flaw does

The vulnerability sits in Broadcom’s implementation of Wi-Fi Protected Setup, or WPS, the feature that allows devices to join a wireless network without manually entering its password. Kaiser says the code mishandles fragmented WPS messages, allowing a nearby attacker to corrupt memory and build both an information-disclosure exploit and an arbitrary-code-execution exploit.²

In one demonstration against an Orange Belgium gateway, the attack read the stored Wi-Fi password from the router and sent it back over the air. Against a Proximus gateway, the exploit opened a reverse shell carried through Wi-Fi frames, meaning it did not need an external command-and-control server. Both demonstrations worked without a login or a completed WPS pairing process, according to Kaiser’s technical write-up.²

The researcher tested the issue on several Belgian networks, including devices from Proximus, Orange Belgium and VOO. He says a fourth provider may also be affected, but he could not test the relevant hardware. The underlying Broadcom code appears in products from many vendors, so the exact impact depends on the chipset, firmware and router manufacturer rather than on one brand of consumer gateway.²

No CVE and no universal fix

Kaiser traces the vulnerable code back to at least 2010 and says Broadcom issued an incomplete fix in 2018 before recommending a move to the hostapd Wi-Fi software package. He divides the affected chips into older eCos-based families, where he found no usable fix, and newer Linux-based families that could potentially be repaired if manufacturers migrate their Wi-Fi software.²

As of the researcher’s latest update, the affected devices he checked remained unpatched. He also says Broadcom declined to assign a CVE, and that the CERT Coordination Center closed his case because Broadcom controls CVE assignment for its products. The Hacker News found no CVE for the flaw as of 19 October.¹²

For defenders, Kaiser has published YARA rules and a firmware-checking script that can help identify vulnerable code. He stresses that these are triage tools: a match does not prove that a device is exploitable, and a clean result is not a substitute for checking with the manufacturer or internet provider.²

Our opinion

This is exactly the sort of router flaw that gets missed because it sits below the level most households can see. The attack does not require a stolen Wi-Fi password or an internet-facing admin panel; proximity is the key requirement, which makes homes, offices and hotels particularly uncomfortable environments for unpatched equipment.

The lack of a CVE and a clear patch path makes the situation harder to manage. Owners should identify the model and firmware of their router, ask the ISP or manufacturer whether it is affected, and replace unsupported hardware rather than assuming that a password change solves the problem. The vulnerability is in the Wi-Fi implementation, not merely in a weak password.

Hero image: Photo by Jakub Zerdzicki on Pexels.³