Researcher Quentin Kaiser disclosed WPSplinter, two bugs in Broadcom’s proprietary Wi-Fi Protected Setup (WPS) code dating back to at least 2010. Someone in Wi-Fi range can send crafted WPS messages, corrupt the router’s memory and run code on it, with no Wi-Fi password and nothing for the owner to do.
What we know
- Kaiser showed working exploits on ISP routers in Belgium, including pulling the Wi-Fi password from memory and joining the network. He estimates about 1.56 million affected gateways in Belgium alone, and Broadcom’s Wi-Fi code is used across hundreds of products worldwide.
- He says Broadcom knew in 2018, shipped a partial fix without disclosure, and recommended vendors move to open-source hostapd.
- Older eCos-based chips (BCM3380, BCM3383, BCM33834) may never get a fix: a “forever day.” Linux-based BCM3390, BCM65xx and BCM68xx devices depend on their vendors.
- Broadcom declined to assign a CVE. As of October 15, none of the devices he identified had a patch. No attacks in the wild have been reported.
What I’d do
- Turn off WPS in your router’s admin page. Almost nobody needs it.
- Check your router and ISP for firmware updates.
- If your router is old and the vendor has moved on, consider replacing it or putting your own access point behind it.
My take
Kaiser also credited frontier AI models with turning months of research into much less. That cuts both ways, which is why “no CVE, no patch” is not acceptable for a bug like this.
