A 16-year-old Broadcom Wi-Fi flaw could enable an attacker within radio range to run commands as root on affected routers without authentication, take over networking devices, and exfiltrate data.
The flaw affects Broadcom’s Wi-Fi Protected Setup (WPS), a network security standard that allows a device to join a network without typing a password by using a PIN or a physical button on the router.
Dubbed WPSplinter, the security vulnerability was introduced in 2010, and Broadcom tried to patch it in 2018. The security vulnerability can be triggered remotely without knowing the network key or normal WPS enrolment.
Security researcher Quentin Kaiser demonstrated the proof of concept at the Hexacon conference in Paris by exploiting Belgian internet service providers, Proximus and Orange.
“Against a Proximus gateway, the Sagemcom-built BBOX3V+, the exploit opened a reverse shell, a remote command line, carried over Wi-Fi frames, so no outside server was needed,” the researcher wrote.
Kaiser used AI, specifically OpenAI’s Codex, to discover the security vulnerability, completing the work in weeks instead of months and at a fraction of the cost, highlighting AI’s growing role in cybersecurity.
The researcher reported the bug on July 18 and July 27, leaving a 90-day reporting window to enable device manufacturers and ISPs to respond. By October 15, when the security vulnerability became public knowledge, none of the affected networking devices had been patched.
Broadcom Wi-Fi flaw results in device takeover
Introduced in 2010, the Wi-Fi flaw stems from a Broadcom memory-handling error that causes the networking device to combine more data than its memory can handle. The memory overflow bug could enable an attacker to overwrite parts of the device’s memory, enabling them to exfiltrate data, execute code, or take over the device.
Additionally, the attacker does not need the router’s password to trigger the flaw; they only need to be within radio range, allowing them to exploit devices in nearby buildings without logging in or pairing the device.
“These kinds of vulnerabilities are perfect for threat actors that enjoy Nearest-Neighbor Attacks or hotel network compromises,” Kaiser explained. “Highly targeted, over the air, against devices which defenders have very limited visibility into, allowing for traffic manipulation and collection.”
It affects various networking devices that use Broadcom chips, including TP-Link, NetGear, Cisco, Movistar, Nokia, and ZTE. The security researcher estimated that the Wi-Fi flaw affects over 1.5 million routers in Belgium alone.
“It affects dozens of vendors, hundreds of products, and millions of Broadcom-based access points worldwide,” the researcher stated.
16-year-old Broadcom Wi-Fi flaw remains unpatched
Meanwhile, Broadcom has been aware of the Wi-Fi flaw since 2018, when it released a partial security patch but failed to assign a CVE, leading to many OEM manufacturers failing to patch the vulnerability. To mitigate the risk, Broadcom also recommended using open-source hostapd on Linux systems instead of its proprietary implementation.
However, Broadcom claims the affected software was beyond its support window. Unwilling to patch the security vulnerability, many device manufacturers are also unlikely to fix the Wi-Fi flaw. Kaiser called the Wi-Fi flaw a “forever day” security vulnerability, meaning it might never be fixed.
“This is not the first case of software being classified as obsolete but still deployed in millions of devices, and it will not be the last,” said Seemant Sehgal, Founder & CEO, BreachLock. “The gap between what a vendor is responsible for maintaining and what still handles live traffic leaves real exposure.”
“For ISPs, now is the time to review whether the devices they ship to customers have a documented end-of-support date, because the lack of one is how 1.5 million routers end up running vulnerable firmware with no path to a fix. For home users, the practical takeaway is that routers have a shorter useful security life than most people realize, and if yours came from your ISP more than a few years ago, it is probably running software that no one is responsible for keeping secure anymore,” added Sehgal.
Nevertheless, the tech company has replaced the vulnerable component in newer software, although older devices remain vulnerable. Consequently, users should consider replacing older devices with newer supported models. Additionally, the researcher also released a wireless scanning script and a YARA rule to help network defenders in threat hunting.
