Broadcom Wi-Fi Flaw Allows Unauthenticated Root Access to Routers
Researchers demonstrate that a flaw in Broadcom’s Wi-Fi software lets attackers bypass passwords and execute code with root privileges on affected routers.
Key points
- The vulnerability exists in Broadcom’s implementation of Wi-Fi Protected Setup (WPS) and allows remote code execution without authentication.
- Researcher Quentin Kaiser demonstrated the flaw on devices from Orange Belgium and Proximus, gaining full control without network access.
- The weakness has been present in Broadcom’s software development kit since at least 2010, according to findings by QTNKSR.
Security researchers have demonstrated a critical flaw in Broadcom’s Wi-Fi software that allows attackers to take full control of vulnerable routers without knowing the Wi-Fi password. The vulnerability enables unauthorized remote code execution with root privileges, giving attackers the highest level of control on Linux-based systems.
The issue stems from how Broadcom’s software handles fragmented messages during Wi-Fi Protected Setup (WPS) communication. Researcher Quentin Kaiser showed that errors in message reassembly lead to memory corruption, which can be exploited to read sensitive data or run arbitrary code. This bypasses the need for normal WPS setup or network authentication.
Vulnerability Context and History
Researchers from QTNKSR identified and documented the vulnerability across various Broadcom Wi-Fi platforms. Their findings indicate that the flaw has been present in Broadcom’s software development kit since at least 2010. This adds to previous concerns about Broadcom Wi-Fi chip flaws, although those earlier reports affected different products and components.
The attack does not require malware or access to a router’s web administration page. Instead, it operates over the air via Wi-Fi frames. An attacker within wireless range can craft specific messages to trigger memory disclosure or remote code execution. The research notes that the attack can work over a distance, not just when standing next to the device.
Affected Devices and Demonstrations
The flaw affects routers that use Broadcom’s Wi-Fi software implementation for WPS. Tests by the researchers showed the vulnerability reaches devices supplied by several internet providers. In one demonstration, Kaiser used the code execution to retrieve the Wi-Fi network key stored on an Orange Belgium ASKEY TCG3000 gateway.
In another test, he obtained a reverse shell from a Proximus gateway using Wi-Fi frames. These demonstrations highlight the severity of the risk, as attackers can move from being nearby to fully controlling the router. Routers often carry traffic from many devices, making them high-value targets for interception or manipulation.
What should you do?
No patch or fix has been confirmed yet for this specific vulnerability. Users should monitor official channels from their internet service providers and Broadcom for updates. Until a fix is available, the primary defense is limiting physical proximity to the router, though the research indicates attacks can occur over distance.
What to do and how to stay safe: Broadcom
- Check with your internet service provider to determine if your router uses Broadcom Wi-Fi software and if a firmware update is available.
- Disable Wi-Fi Protected Setup (WPS) in your router’s administration settings if the option is available, as this feature is central to the exploit.
- Ensure your router’s firmware is updated to the latest version released by the manufacturer, as vendors may address known SDK issues in patches.
- Monitor network traffic for unusual activity, as full root access could allow attackers to install backdoors or intercept data.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do I need to be connected to the Wi-Fi to be affected?
No, the attacker does not need to join the network or enter the password; they only need to be within wireless range to send crafted WPS messages.
Is this vulnerability being exploited in the wild?
The source material describes a research demonstration and a weakness in router software; it does not state that the flaw is currently being abused in active attacks.
Which specific routers are confirmed to be vulnerable?
The researchers demonstrated the flaw on an Orange Belgium ASKEY TCG3000 gateway and a Proximus gateway, noting that the issue affects devices supplied by several internet providers.
