Unpatched Broadcom Wi-Fi Flaw Threatens Some Routers

A security researcher found a flaw in Broadcom Wi-Fi software that could let a nearby attacker take control of some routers without knowing the network password. According to The Hacker News, no fix has been deployed to the tested routers, and some older devices may never receive one.

What happened

The flaw affects Broadcom’s implementation of Wi-Fi Protected Setup, or WPS. Researcher Quentin Kaiser found that specially crafted, fragmented WPS messages could corrupt a router’s memory, allowing an attacker within Wi-Fi range to read information or run code with root-level control.

In demonstrations reported by The Hacker News, the attack recovered a Wi-Fi password from an Askey TCG3000 supplied by Orange Belgium. A separate test opened a remote command shell on a Sagemcom BBOX3V+ supplied by Proximus. Neither attack required a login or pairing step.

Kaiser reported no known attacks in the wild. His working exploits were created for research. No CVE tracking number has been assigned, and the article says Broadcom has known about the underlying bug since 2018.

Who is affected

The confirmed tests involved gateways supplied by Belgian internet providers, not US providers. Specific affected US router models have not been disclosed.

Kaiser identified older eCos-based Broadcom chip families BCM3380, BCM3383 and BCM33834 as vulnerable, with no usable fix available. He said newer Linux-based BCM3390, BCM65xx and BCM68xx devices could be repaired if manufacturers move to different Wi-Fi software.

Broadcom code appears in routers and access points from many manufacturers, but the broader device list includes both confirmed and merely suspected products. A listed model should therefore be investigated rather than automatically treated as compromised.

What to do now

1. Identify your router. Check the label on its bottom or back, then open its app or administration page and look under About, Status, System or Device information. Record the manufacturer, model, hardware revision and firmware version.

2. Ask the manufacturer or your internet provider whether that exact model uses one of the affected Broadcom chip families. Also ask whether its WPS software has been replaced with hostapd or otherwise fixed. Do not rely on a changed Wi-Fi password: the demonstrated attack did not require one.

3. Check for firmware under Administration, System or Firmware Update in the router interface. Install any update offered for your exact model and enable automatic updates if that option exists. The source does not report an available patch for the tested gateways, so an ordinary update may not resolve this specific flaw.

4. Request a replacement from your provider if it cannot confirm that its gateway is safe and supported. Replacement is the practical option for older affected hardware that cannot be repaired. Our router update guide explains how to tell whether a router still receives security fixes.

5. Do not assume that switching off the visible WPS button fully blocks the problem. According to The Hacker News, Kaiser has not identified a router setting that stops this over-the-air attack. Turn off and unplug any old access points or provider gateways you no longer use.

How to protect your home network

Because this attack targets the router itself, separate smart devices from computers where possible and review connected devices for anything unfamiliar. CyberSec24’s home network security guide covers updates, network separation and safer router settings.