Unpatched Broadcom WPS Bug Exposes Millions of Routers Without a CVE
A 16-year-old parser flaw in Broadcom code lets attackers hijack routers over Wi-Fi without a password. A lack of CVE numbers left vendors blind.
Security researcher Quentin Kaiser has detailed an unpatched vulnerability dubbed WPSplinter, located in legacy Broadcom code handling the Wi-Fi Protected Setup protocol. According to the findings, the parser incorrectly handles specific message sequences, allowing an attacker within wireless range to access router memory or execute arbitrary code without needing a Wi-Fi password or completing pairing.
Demonstrations showed that the exploit can extract Wi-Fi keys from non-volatile memory on an Askey TCG3000 gateway or grant a remote shell on a Sagemcom-manufactured Proximus BBOX3V+. Kaiser confirmed affected equipment across major Belgian providers like Proximus, Orange, and VOO, estimating 1.5 million vulnerable devices in Belgium alone. Globally, models from brands including Cisco, TP-Link, Netgear, Nokia, ZTE, and Zyxel use the same chipsets, pointing to potentially hundreds of millions of exposed units.
Broadcom stated it was aware of the issue since 2018, replaced the legacy code in newer software, and declined to issue a CVE because the code is obsolete and unsupported. Kaiser argues that without a CVE identifier, automated update systems and notification tools failed to flag the danger to vendors and ISPs. Changing Wi-Fi passwords or disabling WPS may not eliminate the risk since the vulnerable code can persist. Recommendations include placing the gateway in bridge mode behind an updated independent router.
Source: habr
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.