16-Year-Old Broadcom Wi-Fi Flaw Lets Attackers Hack Routers Without Knowing Passwords

A 16-year-old flaw in Broadcom’s Wi-Fi software can let attackers within wireless range take control of affected routers without knowing the network password.

Security researcher Quentin Kaiser disclosed the issue at Hexacon in Paris on October 16, 2026, warning that old code remains in widely deployed devices.

According to Kaiser’s research, the flaw has existed in Broadcom’s software development kit since at least 2010. It affects its proprietary Wi-Fi Protected Setup (WPS) implementation. It allows memory leaks and attacker-controlled code execution before normal WPS enrollment finishes.

The flaw sits in code that joins fragmented Extensible Authentication Protocol messages used by WPS. Weak length checks allow crafted wireless messages to overflow a memory buffer.

16-Year-Old Broadcom Wi-Fi Flaw

Attackers can then read or change memory and redirect the router’s program flow to run their own code. This is an over-the-air attack, not a password-cracking method. The attacker needs wireless reach to the target but not its network key.

Kaiser demonstrated stealing the saved Wi-Fi password from an Orange Belgium ASKEY TCG3000 router and sending it back through wireless frames. He then joined the network using the stolen password.

A second demonstration against a Proximus BBOX3V+ provided a remote command shell over Wi-Fi frames without a cloud command server. These tests show why a strong password alone cannot stop exploitation of the affected software.

Kaiser confirmed exploitation on devices used by three Belgian internet providers. These include Proximus BBOX3V+, VOO’s Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233, and Orange’s ASKEY TCG3000. Possible exposure involving Telenet equipment remains unconfirmed.

His estimates place the affected Belgian fleet at roughly 1.56 million gateways across Proximus, legacy VOO, and Orange. These are researcher estimates, not verified provider totals. He warns that the wider issue could affect millions of access points worldwide, although the full count remains unknown.

The finding follows earlier Broadcom-related wireless security concerns, including the separate Kr00k Wi-Fi vulnerability. The new research concerns WPS message handling rather than that earlier flaw.

Kaiser describes a 2018 patch as incomplete. In correspondence reproduced in his slides, Broadcom said it had long known about the issue and had offered replacement software based on hostapd and WPA Supplicant since 2018. That leaves device makers responsible for moving away from the old implementation.

Kaiser reported the eCos issue on July 18 and the Linux issue on July 27. He says Broadcom declined to assign a CVE, and the tested Belgian devices remained unpatched as of October 15.

His detection toolkit includes a wireless fingerprinting script and YARA rules for firmware checks. These are screening tools, not final proof of exploitability. Findings need further review.

The risk also draws renewed attention to Nearest-Neighbor attacks, where compromised nearby systems provide wireless reach. That case used different methods, but shows why nearby Wi-Fi exposure matters.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.