Security researcher **Quentin Kaiser** has unveiled a significant flaw within **Broadcom**'s implementation of **Wi-Fi Protected Setup (WPS)**. This vulnerability enables an attacker, operating within radio range, to achieve root-level code execution on **Broadcom**-based routers without requiring the network password or any prior pairing. Demonstrating the severity, Kaiser successfully exploited the flaw against home gateways provided by three major Belgian internet providers. In one instance, he extracted the **Wi-Fi** password directly from the device; in another, he established a remote shell over the air. Importantly, no **CVE** has been assigned to this vulnerability, and according to Kaiser, no fix has been deployed to the affected routers. ## The Technical Breakdown The core of the flaw lies in **Broadcom**'s **WPS** code, specifically in its handling of fragmented **WPS** setup messages. Maliciously crafted messages can lead to memory corruption on the router. Kaiser leveraged this to develop two distinct exploits: one capable of reading memory from the device, and another for arbitrary code execution. For an **Orange Belgium** gateway, the **Askey TCG3000**, Kaiser was able to read the **Wi-Fi** Pre-Shared Key (**PSK**) from the router's stored settings, transmit it wirelessly, and then join the network. Against a **Proximus** gateway, the **Sagemcom**-built **BBOX3V+**, the exploit opened a reverse shell—a remote command line—entirely carried over **Wi-Fi** frames, eliminating the need for an external server. Both attacks were executed without any form of authentication and are effective at a distance. Kaiser reports no real-world attacks utilizing this specific flaw, noting that the working exploits are his own creations. ## Scope of Affected Devices **Broadcom**'s **WPS** code is integrated into routers and access points from numerous vendors. Kaiser estimates that millions of devices worldwide are vulnerable. Two primary chip families are implicated: * **Older eCos-based models**: This includes the **BCM3380**, **BCM3383**, and **BCM33834**. For these, Kaiser found no viable fix, labeling the bug a "forever day"—a permanent flaw unlikely to ever be patched. * **Newer Linux-based models**: Such as the **BCM3390**, **BCM65xx**, and **BCM68xx**. These devices could potentially be patched if their manufacturers transition to different **Wi-Fi** software. In Belgium, Kaiser confirmed the vulnerability and exploitability on gateways from **Proximus**, **Orange Belgium**, and **VOO**. While **Telenet** may also be affected, he was unable to conduct tests. A broader list published by Kaiser includes devices from **Cisco** small-business access points to **Huawei** and **ARRIS** routers. This list, however, comprises both confirmed and unconfirmed entries, with some flagged as "likely vulnerable" based on automated checks. Belgian provider-specific counts, though rough, are estimated to be in the hundreds of thousands of gateways. ## The Absence of Patches and CVEs The flaw's origins trace back to at least 2010. **Broadcom** reportedly shipped an incomplete fix in 2018 and advised customers to switch to an alternative **Wi-Fi** software package, **hostapd**, rather than relying on their fix. Critically, for the older **eCos** chips, no working fix was ever provided, reinforcing the "forever day" designation. Adding to the concern, no **CVE** has been assigned to this vulnerability. Kaiser states that **Broadcom** acknowledged knowing about the bug since 2018 and had received reports from others, but declined to register a **CVE** or make a public statement. This, he believes, is a key reason why many device manufacturers failed to issue patches. Attempts to register the case with the **CERT Coordination Center** were closed the same day, as **Broadcom** holds the authority to assign **CVEs** for its products and chose not to. ## Recommendations for Defenders Given the lack of an official patch and no specific setting to block the over-the-air attack, Kaiser offers defensive aids to identify vulnerable equipment: * **YARA rules**: These can detect the vulnerable code within extracted firmware. * **Scanning script**: A script that listens to a live access point and indicates potential vulnerability. Kaiser emphasizes that these are triage tools; a device might still match the rules even if patched, requiring further investigation. For hardware that will never receive a fix, replacement remains the most practical solution. Kaiser highlights that this type of bug is particularly attractive to attackers who target systems via proximate **Wi-Fi** rather than over the internet. This technique has been famously employed by state-sponsored actors, such as Russian APT groups, to breach networks from nearby locations.