Broadcom Wi-Fi Flaw Lets Nearby Attackers Get Root on Routers

A newly disclosed Broadcom Wi-Fi flaw lets an attacker within radio range run code as root on many home routers and gateways, and the attacker does not need the network password. Security researcher Quentin Kaiser published the findings on October 16, and security outlets picked them up this week. No patch or CVE has been issued, so most owners cannot fix the problem with a software update yet.

The flaw sits in Broadcom's implementation of Wi-Fi Protected Setup, or WPS. That feature lets a device join a network without anyone typing in the password, and vendors embed it in routers and access points made by many companies. In Kaiser's analysis, Broadcom's code mishandles fragmented setup messages, and crafted packets can corrupt router memory.

What the Broadcom Wi-Fi flaw means for routers

Root is the highest level of control on a Linux-style system. An attacker with root access can change settings, inspect traffic and use the device as a foothold on the home network. The attacker does not need a login, a phishing email or a malicious app on any device in the house. Proximity is the only requirement, which lowers the bar for a neighbor, a tenant in the next unit or someone sitting in a parked car on the street.

That is what sets this disclosure apart from many router bugs. Remote attacks usually need a path from the internet to the device. This one needs only radio range.

How the attack works on Belgian gateways

Kaiser tested two gateways supplied by Belgian internet providers, and the results show two different outcomes. Against an Orange Belgium gateway built on the Askey TCG3000, the exploit pulled the Wi-Fi pre-shared key from stored settings and sent it over the air. That gave the attacker what was needed to join the network.

Against a Proximus gateway using the Sagemcom BBOX3V+, the exploit opened a reverse shell carried over Wi-Fi frames. No outside server was needed, so the connection ran over the wireless signal itself.

Kaiser put the practical risk in one line on his blog: “This means you can get a root shell from across the street on a significant proportion of routers in Belgium, and probably elsewhere.” The second half of that sentence is the part readers outside Belgium should weigh.

Kaiser presented the research at Hexacon in Paris on October 16, according to a post from Dark Web Intelligence summarizing the disclosure. He said the devices he tested were still unpatched as of October 15. The Hacker News reported the flaw in similar terms. Kaiser reports no real-world attacks using the flaw, though that is not the same as proof that none are happening.

Which routers and ISPs are affected

The vulnerable Broadcom chips fall into two families, and they differ sharply in how fixable they are. The older models run eCos, and Kaiser found no usable fix for them. The newer models run Linux and could be patched if device makers update their Wi-Fi software.

On the provider side, Kaiser found the flaw exploitable on gateways from Proximus, Orange Belgium and VOO. Telenet may also be affected, but he could not test it, so it stays on the list as a possibility rather than a confirmed case.

The reporting reviewed for this story describes exposure only in Belgium. It does not identify any U.S. router models or U.S. internet providers, so U.S. exposure remains unverified.

Device counts are also unsettled. Kaiser estimates millions of devices worldwide, according to a DEV Community write-up. An earlier write-up, published by Mallory, cites ESET saying more than one billion devices were affected. That figure cannot be verified from the available material and does not reconcile with Kaiser's estimate, so treat the billion-device number as unconfirmed.

Why there is no patch yet

Broadcom has not issued a CVE for the flaw. According to a secondhand account, Broadcom told Kaiser that a fix has been available since 2018 and declined to assign a CVE. No official Broadcom statement confirming either point has surfaced, so readers should treat that account as unconfirmed.

Kaiser says the flaw has been in Broadcom's software development kit since at least 2010. If that is accurate, the code has traveled through many product generations, and each device maker that built on it had to decide whether and when to ship updates.

That is the real bottleneck. A chip maker can ship a fix, but a router or gateway does not change until the company that packages the software updates its firmware and an internet provider pushes that update to customers. Browser fixes like Google's recent round of Chrome patches move through a single update channel that the vendor controls. A router fix passes through a chip maker, a device maker and, for many households, an internet provider that supplied the box.

The losers are customers who never chose their gateway and cannot easily replace it. The people who gain are attackers willing to sit within range of a target.

Who is exposed and how the French fridge attacks compare

The French fridge incident is about a week old and involves a different kind of device. Danfoss refrigeration controllers were hijacked in France on October 11. CERT-FR has said it is aware of numerous compromises involving Danfoss and Copeland equipment. CNN reported that the French firm Danfoss and the U.S.-based Copeland, which owns Dixell, were both involved. ABC News noted that the attacks resemble disruptions reported at about a dozen U.S. military commissaries in late August.

Both stories share a pattern. Connected equipment at the edge, often owned by someone who cannot monitor it closely, becomes the entry point. The router case is more troubling in one respect, because the attacker needs no path from the internet at all. USA 24 recently reported on the Palo Alto PAN-OS zero-day, CVE-2026-0322, which is being exploited, a reminder that perimeter devices keep drawing attention.

What to do if your router uses a Broadcom chip

Start by identifying the device. The router's label, its admin page or your internet provider can tell you the model. Then work through these steps:

• Ask your internet provider whether your gateway uses a listed Broadcom chip and whether a firmware update is planned. Belgian customers of Proximus, Orange Belgium, VOO or possibly Telenet should start there.
• Install any vendor firmware update as soon as it is offered, and check the admin page for updates rather than waiting for a notice.
• Restrict or remove internet exposure of the router's management interface, a step recommended in general guidance on the flaw.
• If the admin page has a WPS option, consider turning it off while you wait, since the flaw sits in WPS. Confirm with your provider that this applies to your model.
• Kaiser released a fingerprinting toolkit to help identify affected access points, according to the Dark Web Intelligence post. Technical staff can use it to check hardware on their networks.
• In an apartment building, office or public space, assume that anyone within range could reach a poorly protected access point.

What to watch next

Three signals will matter in the coming weeks. The first is whether Broadcom confirms the 2018 fix date and whether a CVE appears, since a CVE gives device makers, scanners and customers a shared identifier to track. The second is whether Proximus, Orange Belgium, VOO and Telenet publish firmware for their gateways, and whether any update reaches the older eCos models. The third is whether a U.S. internet provider or router maker confirms exposure. Kaiser's toolkit makes that last question easier to answer, and it also shortens the window between disclosure and patching, because anyone who wants to check a device can now use it.