A long-standing vulnerability in Broadcom’s Wi-Fi software has been found to allow attackers within wireless range to compromise vulnerable routers without needing the network password, raising concerns about the security of millions of devices still running legacy code.
Security researcher Quentin Kaiser revealed the flaw during his presentation at Hexacon 2026 in Paris, highlighting how a weakness hidden in Broadcom’s codebase for more than 16 years continues to affect widely deployed networking equipment. According to his findings, the vulnerability dates back to at least 2010 and resides within Broadcom’s proprietary implementation of Wi-Fi Protected Setup (WPS).
The issue stems from the way the software processes fragmented Extensible Authentication Protocol (EAP) messages during the WPS enrollment process. Improper validation of message lengths enables specially crafted wireless packets to trigger a buffer overflow, potentially exposing sensitive memory contents and allowing attackers to execute arbitrary code on the device before authentication is completed.
Unlike traditional attacks that rely on guessing or cracking Wi-Fi passwords, this weakness can be exploited entirely over the air. An attacker only needs to be within wireless range of the target router, eliminating the need for any valid credentials or prior access to the network.
Kaiser demonstrated the impact of the flaw by targeting an Orange Belgium ASKEY TCG3000 router, successfully extracting the device’s stored Wi-Fi password and transmitting it back through crafted wireless frames. After obtaining the credentials, he was able to connect to the network as a legitimate user.
In a separate proof-of-concept, he exploited a Proximus BBOX3V+ router to obtain a remote command shell through Wi-Fi communications alone, without relying on an external command-and-control server. These demonstrations underscore that even strong, complex Wi-Fi passwords offer little protection when the underlying router software itself is vulnerable.
The researcher verified successful exploitation across devices supplied by multiple Belgian internet service providers. Confirmed affected models include the Proximus BBOX3V+, Orange ASKEY TCG3000, VOO Netgear CG3100 and CG3700, and Technicolor TC7210 and CGA4233 gateways. Potential exposure of equipment used by Telenet has not yet been confirmed.
Based on deployment estimates, Kaiser believes approximately 1.56 million broadband gateways in Belgium alone could be affected across networks operated by Proximus, Orange, and legacy VOO infrastructure. While these figures are estimates rather than provider-verified numbers, he cautions that the true global footprint may extend to millions of wireless access points and residential gateways worldwide.
The disclosure adds to a history of wireless-security issues involving Broadcom technology, though it is unrelated to the previously publicized Kr00k vulnerability. Whereas Kr00k involved encryption key handling, the newly disclosed flaw is rooted in unsafe processing of WPS protocol messages.
Kaiser further argues that Broadcom’s previous remediation efforts were insufficient. He points to a patch released in 2018 that he describes as incomplete. Documentation included in his presentation indicates Broadcom acknowledged the issue years ago and recommended that vendors migrate to alternative wireless software stacks based on hostapd and WPA Supplicant. As a result, responsibility for fully replacing the vulnerable implementation largely fell to device manufacturers.
According to Kaiser, reports concerning affected eCos and Linux implementations were submitted to Broadcom in July 2026. He states that the company declined to assign a CVE identifier to the issue and that the Belgian devices involved in his testing remained unpatched as of October 15, 2026.
To assist security teams, Kaiser released detection resources that include wireless fingerprinting tools and YARA-based firmware scanning rules. However, he notes that these tools are intended for identifying potentially vulnerable devices and should not be considered definitive proof that a given system can be successfully exploited.
The research also renews concerns about Nearest Neighbor-style attack scenarios, in which compromised nearby systems can provide the physical wireless proximity needed to launch attacks. While those techniques leverage different exploitation methods, they reinforce the broader security challenge posed by attackers operating within Wi-Fi range of vulnerable infrastructure.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
