Broadcom's 16-year-old Wi-Fi bug still lets strangers hijack routers

For sixteen years, a flaw buried in Broadcom's Wi-Fi software has done something security experts dread: let a stranger take over your router without the password. Security researcher Quentin Kaiser dubbed it "WPSplinter" and demonstrated working attacks against routers from ASKEY, Netgear, and Technicolor, pulling Wi-Fi credentials straight out of a device's memory. The bug is not theoretical, and it is not rare. Kaiser estimates roughly 1.56 million gateways in Belgium alone could be affected, split across Proximus, VOO, and Orange Belgium, and because Broadcom sells to dozens of manufacturers, the count worldwide could be far higher.

The most uncomfortable part is how long Broadcom knew. Kaiser says the chipmaker was aware of the vulnerability in 2018 and shipped an attempted fix eight years after the underlying bugs first appeared in Broadcom's proprietary Wi-Fi implementation, dating back to at least 2010. That fix, he says, did not fully resolve the problem. The vulnerability sits in Wi-Fi Protected Setup (WPS), the convenience feature that lets users connect gadgets without typing a long passphrase. By sending specially crafted WPS messages, an attacker within Wi-Fi range can corrupt router memory and execute their own code. No password needed, and the router owner does nothing.

Kaiser's proof of concept includes a detailed attack on an ASKEY TCG3000 gateway supplied by Belgian ISP Proximus. He ran code on the device, extracted the Wi-Fi password from memory, sent it back over the air, and then used those stolen credentials to join the network. He also found the flaws in Netgear and Technicolor routers supplied by VOO. His estimates put about 850,000 Proximus gateways, 500,000 VOO gateways, and 210,000 Orange Belgium gateways at risk. He admits those are rough numbers, but the combined total of roughly 1.56 million is a striking figure for a small country.

The exposure goes far beyond Belgium. Broadcom's Wi-Fi technology shows up across hundreds of products from dozens of manufacturers. Kaiser says owners of routers running Broadcom's older eCos-based chips, including the BCM3380, BCM3383, and BCM33834, are in a particularly grim spot. He calls the flaw a "forever day," meaning those devices may never get a fix. Routers using Linux-based BCM3390, BCM65xx, and BCM68xx chips are not necessarily safe either, unless their manufacturers switch to the open-source hostapd software that Broadcom recommended after its partial fix.

The reporting timeline shows a broken vulnerability disclosure process. Kaiser first reported the issues to Broadcom on July 18, followed by a second report July 27, giving the company and affected vendors 90 days before public disclosure. Broadcom responded July 28 saying a patch was available and pointed him to manufacturers. But the next day, it declined to assign a CVE identifier or give him a copy of the notification it said it sent through its customer portal. Kaiser also contacted Proximus, tried to reach Orange Belgium and VOO, and alerted Belgium's national cybersecurity authorities. He opened a case with CERT/CC, which closed it August 4 because Broadcom, itself a CVE Numbering Authority, declined to register the vulnerability.

As of October 15, the day before his presentation, Kaiser said none of the affected devices he identified had received a patch. There is no evidence of attacks in the wild yet, but the risk profile is clear. Someone parked outside a home or office could compromise a vulnerable router, steal network credentials, or mess with traffic. For consumers and businesses, that makes many older gateways a silent liability.

There is a notable twist in how he found it. Kaiser credits frontier AI models with speeding up the investigation, saying what would normally take months took less than a week. That points to a future where vulnerability research moves faster than patch cycles, making the gap between discovery and disclosure even more dangerous.

For executives, the lesson is about supply-chain visibility. When a chipmaker says a fix is ready but cannot name the customers who got it, and a CVE is never assigned, device makers and enterprise buyers are left blind. The open-source shift Broadcom recommended, moving from proprietary WPS handling to the hostapd software, is one path forward, but it only works if manufacturers ship updates to devices people actually own. The "forever day" problem is a reminder that hardware in the field often outlives the security support that was promised for it.