Broadcom WiFi Flaw Could Let Nearby Hackers Take Over Millions of Routers

A legacy flaw in Broadcom’s WiFi Protected Setup software may leave millions of older routers vulnerable to nearby attackers who could potentially execute malicious code without knowing the network password.

Security researcher Quentin Kaiser demonstrated the vulnerability at the Hexacon conference in Paris after analysing affected router firmware. The flaw is present in older Broadcom WiFi software used across devices supplied by internet providers and manufacturers including Movistar, Cisco, TP-Link, Netgear, Nokia and ZTE.

Kaiser estimates that around 1.5 million routers in Belgium alone may be affected, although he described the figure as rough and said the global number remains unknown.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

Attack Does Not Require WiFi Password

The vulnerability stems from a memory-handling error in Broadcom’s WPS software dating back to around 2010.

According to Kaiser, an attacker can send specially crafted WPS connection messages to a vulnerable router. The messages can cause the device to process more data than its memory can safely handle, potentially overwriting memory and allowing information theft or execution of malicious code.

An attacker would not need the WiFi password or prior access to the network. They would only need to be within wireless range of the affected device.

Kaiser said this makes the flaw suitable for highly targeted attacks, including compromises from neighbouring buildings or hotel rooms, where an attacker may be physically close enough to reach the router over WiFi.

He also said the practical attack range could extend beyond what was visible in his demonstration.

Affected devices identified in Spain include three older router models supplied by Movistar and manufactured by Askey, MitraStar and Comtrend. The ZTE F680 v4, distributed by Spanish operator MasMovil and internet providers in countries including Vietnam, Egypt and Moldova, was also identified as affected.

Researcher Says Broadcom Knew of Issue Since 2018

Kaiser said Broadcom had been aware of the issue since 2018 but had not assigned it a formal CVE identifier or issued a public disclosure because the affected software was obsolete and outside its support window.

According to the researcher, Broadcom replaced the vulnerable component in newer software, but older devices continued using the affected implementation.

Kaiser said the absence of a public disclosure may have contributed to manufacturers failing to issue patches for older equipment.

Broadcom had been approached for comment.

Kaiser estimated that about 850,000 routers supplied by Proximus, 500,000 devices from VOO and 210,000 from Orange Belgium could be affected. He cautioned that these were approximate figures rather than a definitive count.

Firmware Updates Advised for Older Routers

Kaiser has released a free tool on GitHub designed to help identify potentially affected equipment. It includes a wireless scanning script and a YARA rule that checks router firmware for patterns associated with the vulnerable software.

Owners of older routers have been advised to contact their internet provider or device manufacturer to determine whether a firmware update is available and to consider replacing unsupported equipment.

Kaiser warned that disabling WPS may not necessarily remove the risk. He said the affected devices he examined remained unpatched as of October 15.

The researcher also said he used OpenAI’s Codex coding agent in GPT-5.6 mode to analyse router firmware and develop exploits, which he said significantly reduced the time required for the research.

The vulnerability highlights the continuing risks posed by unsupported networking equipment, particularly when flaws remain embedded in widely deployed legacy software.