Anyone within reach of a router’s Wi-Fi signal can send it a series of malformed setup messages and, on a family of Broadcom-based home gateways, end up running code as root. No network password is needed and no one has to be logged in. Security researcher Quentin Kaiser disclosed the flaw on October 16, 2026, and the devices he tested were still unpatched when his write-up received its last update on October 20.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Broadcom has declined to assign the bug a CVE identifier, which leaves defenders without a tracking number to search for. By Kaiser’s account, the company has known about the vulnerable code since 2018.
Fragmented setup messages, root privileges and no password
The weakness sits in Broadcom’s own implementation of Wi-Fi Protected Setup, the pairing feature that lets a new device join a network without typing the full key. According to Kaiser’s technical write-up, the code mishandles the reassembly of fragmented WPS messages. Crafted fragments corrupt memory on the access point, and the corruption can be steered into code execution with root privileges. Kaiser traces the code to at least 2010, and his working exploits can also read memory back from the device, which is how one of them recovered a gateway’s Wi-Fi key and joined the network behind it.
Distance is the part Kaiser stresses. He wrote that the attack “works over long distances,” told readers not to be fooled by antenna proximity, and described getting a root shell from across the street on a significant proportion of routers in Belgium. The Hacker News, which reported the disclosure on October 19, confirmed that the bug can be triggered with no login and without the network key.
Radio-range intrusion has precedent. In 2024 the firm Volexity described a Russian group, tracked as GruesomeLarch and publicly known as APT28, that reached a Ukraine-focused organisation by joining its Wi-Fi through compromised networks nearby. Volexity called it a new class of attack.
Two chip groups, two different patch stories
Kaiser’s list divides along the operating system inside the chip. The older eCos-based parts are the BCM3380, BCM3383 and BCM33834; for those he found no usable fix and calls the bug a “forever day.” The Linux-based group comprises the BCM3390, BCM63xx, BCM65xx and BCM68xx families. On the routers he examined, none of the affected devices had been patched as of October 15.
The distinction matters for how the flaw is described. Broadcom told Kaiser on July 28 that a patch was available and that he should take the matter to the device manufacturers. The remedy Broadcom points to is a later SDK that replaces the vulnerable components with hostapd, the open-source daemon that handles authentication on access points and lists WPS among its supported features. On Linux platforms the bug remains what Kaiser calls a “potential forever day” unless router makers migrate. An upstream fix exists for part of the problem; the firmware that households actually run has not received it.
Belgian operator gateways as the test bench
Kaiser tested gear supplied by Belgian broadband providers. His list names the Proximus BBOX 3V+, the Askey TCG3000 from Orange Belgium, and four VOO devices: the Netgear CG3100 and CG3700, the Technicolor 7210 and the CGA4233. The Hacker News reported that the exploit against the Orange unit read the Wi-Fi pre-shared key and joined the network, while the Sagemcom-built Proximus gateway yielded a reverse shell over Wi-Fi frames. Telenet could not be tested at first, and a later update says it is not affected.
Outside Belgium the picture is less settled. The Hacker News said wider lists mention Cisco small-business access points, Huawei and ARRIS equipment, a mix of confirmed and unconfirmed entries, some drawn from an automated check. Kaiser’s GitHub repository supplies YARA rules and a fingerprinting script for live access points, but describes them as triage aids: a patched binary can still match, and the affected-device table has gaps. Kaiser estimates millions of devices worldwide and hundreds of thousands of gateways in Belgium, and calls both figures rough.
A CVE that Broadcom would not register
The disclosure record shows how the gap opened, and why no advisory number exists for administrators to cite. Kaiser reported the eCos chips to Broadcom’s product security team on July 18 and the Linux chips on July 27. On July 29 Broadcom refused to register a CVE or to share its notice to manufacturers. On August 4 a CERT/CC case was closed the day it was opened, because Broadcom is a CVE Numbering Authority for its own products and would not issue an identifier. Kaiser presented the work at Hexacon in Paris on October 16, after communicating the disclosure deadline to all parties.
Operators have begun to move. Kaiser’s October 20 update records that Proximus disabled WPS across its BBOX fleet within 24 hours and plans full patching in the coming weeks, that Orange Belgium was investigating and considering the same step, and that Telenet reportedly found no WPS process running on its fleet. Kaiser reports no real-world attacks; the working exploits are his own. For devices that will never be fixed, he names replacement as the practical option. Whether Orange Belgium and VOO follow Proximus with a fleet-wide shutoff of WPS is the open item.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
