Sit within radio range of a vulnerable gateway and the network password stops mattering. Researcher Quentin Kaiser published details on October 16 of a memory corruption bug in Broadcom’s Wi-Fi Protected Setup code that he exploited across three Belgian broadband providers’ routers.
WPS is the pairing shortcut that joins a device to a network without typing the key. Broadcom’s implementation reassembles fragmented setup messages badly, so crafted frames in range can overwrite router memory. Kaiser then built two primitives on top: one reads memory back out over the air, the other executes his code there.
On an Askey TCG3000 handed out by Orange Belgium he pulled the stored pre-shared key off the device, received it over Wi-Fi, and joined the network. On a Sagemcom-built BBOX3V+ issued by Proximus he opened a reverse shell carried inside Wi-Fi frames, needing no external server. Neither test required a login.
Scope is the problem. The affected silicon sits in access points from dozens of vendors, and Kaiser puts the worldwide population in the millions. Older eCos parts, including the BCM3380, BCM3383 and BCM33834, received no working fix at all; he calls those a forever day. Newer Linux-based chips could be repaired if manufacturers moved to stock hostapd.
No tracking number exists for this flaw. Kaiser traces the defective code to 2010 and says a 2018 repair was incomplete before Broadcom pointed customers elsewhere.
Defenders with Broadcom-based gateways should turn off WPS in the admin interface where the option is offered, and audit whether that interface is exposed to the internet. Where WPS cannot be disabled, replacement is the only reliable path.
