Broadcom Wi-Fi Flaw From 2010 Allows Unauthenticated Router Takeover

A sixteen-year-old vulnerability in Broadcom’s Wi-Fi stack lets attackers execute code on routers without passwords, as demonstrated by researcher Quentin Kaiser at Hexacon.

Threat Times Exposure DeskOctober 19, 20262 min read

Share LinkedIn Reddit

Illustration: A white Wi-Fi router sits on a wooden table with its antennas standing upright. — AI-generated illustration: Threat Times

Key points

The flaw exists in Broadcom’s proprietary 802.11 implementation and has been in their SDK since at least 2010.
Attackers can achieve remote code execution on affected routers without knowing the Wi-Fi password or completing WPS setup.
As of October 15, 2026, affected devices in Belgium had not received a patch, leaving them exposed to exploitation.

Security researcher Quentin Kaiser presented findings at Hexacon in Paris revealing that a vulnerability in Broadcom’s Wi-Fi technology allows attackers to take control of routers. The flaw, which dates back to at least 2010, enables unauthenticated remote code execution on vulnerable devices within Wi-Fi range, bypassing standard security measures entirely.

The vulnerability resides in Broadcom’s proprietary implementation of the 802.11 standard and has persisted in their software development kit for sixteen years. Kaiser noted that an incomplete patch was released in 2018, but Broadcom subsequently recommended moving to hostapd instead. This recommendation effectively made the issue a permanent vulnerability on eCos-based platforms unless manufacturers migrate their entire software stack.

Technical Details and Exploitation

The bug affects the WPS EAP reassembly code, which handles part of the wireless setup process common in consumer routers. An attacker can trigger the vulnerability remotely over Wi-Fi without knowing the network key or requiring any user interaction. Exploitation provides controlled information disclosure and arbitrary code execution, allowing the attacker to run commands on the router.

Kaiser demonstrated the exploit against two specific devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. In his demonstration, he extracted the Wi-Fi password from the router’s memory and transmitted it over the wireless connection. He then used the stolen password to connect to the network, proving the practical impact of the flaw.

Scope and Platform Impact

The vulnerability impacts specific Broadcom chipsets, including the BCM3380, BCM3383, and BCM33834 on eCos-based platforms. It also potentially affects Linux platforms using the BCM3390, BCM65xx, and BCM68xx chipsets. Kaiser stated that these Linux platforms remain vulnerable unless original equipment manufacturers are willing to migrate away from the affected Broadcom SDK components.

As of October 15, 2026, none of the affected devices in Belgium had received a patch. The attack demonstrated by Kaiser did not require a command server accessible over the internet, relying solely on Wi-Fi frames to open a reverse shell. The close antenna placement shown in laboratory videos was not a requirement for the attack, indicating it can work from a distance.

What should you do?

Organizations and users should verify if their routers use Broadcom chipsets, particularly the models identified by Kaiser. Since no widespread patch has been confirmed for all affected devices, administrators should monitor vendor communications for migration guides to hostapd or other secure alternatives.

What to do and how to stay safe: Broadcom

Check router specifications to determine if the device uses vulnerable Broadcom chipsets such as the BCM3380 series or BCM65xx series.
Monitor vendor security advisories for patches or migration instructions, as no universal fix has been confirmed yet.
Restrict physical and wireless access to router environments to reduce the attack surface for unauthenticated exploits.
Review network logs for unusual WPS activity or unexpected code execution indicators that may signal an attempt to exploit this flaw.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Broadcom chipsets are affected by this vulnerability?

The flaw affects eCos-based platforms including BCM3380, BCM3383, and BCM33834, and potentially Linux platforms with BCM3390, BCM65xx, and BCM68xx chipsets.