Broadcom Wi-Fi Flaw Lets Attackers Hijack Routers Without Passwords

Security researcher Quentin Kaiser disclosed a sixteen-year-old vulnerability in Broadcom Wi-Fi software that allows attackers to hijack routers without knowing the network password. The flaw, named WPSplinter, stems from bugs in Broadcom’s proprietary implementation of Wi-Fi Protected Setup (WPS) that date back to at least 2010.

Kaiser claims Broadcom was aware of the issue as early as 2018. Although the chipmaker attempted a fix eight years after the initial discovery, Kaiser asserts that the patch did not fully resolve the underlying problems. The bugs allow specially crafted WPS messages to corrupt router memory, enabling remote code execution for anyone within Wi-Fi range.

Context and Background

Wi-Fi Protected Setup is designed to let users connect devices to a wireless network without manually entering a password. Kaiser found that the specific handling of these setup messages by Broadcom chips creates a memory corruption vulnerability. This allows an attacker to run their own code on the device without any interaction from the router owner.

The researcher demonstrated working exploits against routers supplied by Belgian internet providers Proximus and Orange. In one test against an ASKEY TCG3000 gateway, Kaiser executed code on the device, extracted the Wi-Fi password from memory, and transmitted it back over the air. He then used the stolen credentials to join the network.

Who Is Affected

Kaiser identified the flaw in Netgear and Technicolor routers supplied by VOO as well. He estimates that approximately 850,000 Proximus gateways, 500,000 VOO devices, and 210,000 Orange Belgium routers could be affected. This totals roughly 1.56 million potentially vulnerable routers in Belgium alone, though Kaiser notes these figures are rough estimates.

The problem is unlikely to be confined to Belgium. Broadcom’s Wi-Fi technology is used by dozens of manufacturers across hundreds of products. This widespread adoption means the number of affected devices worldwide could be considerably higher than the Belgian estimates suggest.

What should you do?

No fix has been confirmed yet for this specific vulnerability. Users should monitor vendor announcements for patches or firmware updates. If a vendor provides an update, install it immediately. Until then, disabling WPS on your router may reduce the attack surface, as the flaw relies on this specific feature.

What to do and how to stay safe: Broadcom

• Check if your router supports Wi-Fi Protected Setup and disable it in the administrative settings if possible.
• Monitor official channels from your router manufacturer for firmware updates addressing WPS or memory corruption issues.
• Use strong, unique Wi-Fi passwords to limit the impact if credentials are compromised via other means.
• Review connected devices on your network regularly to detect unauthorized access.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is WPSplinter?

WPSplinter is a security flaw in Broadcom Wi-Fi chips that allows attackers to run code on routers via corrupted WPS messages.

Did Broadcom know about this bug?

Yes, researcher Quentin Kaiser claims Broadcom knew about the flaw since 2018, though an attempted fix was incomplete.

How many devices are affected?

Kaiser estimates 1.56 million routers in Belgium are vulnerable, with global numbers likely much higher due to Broadcom's widespread use.