Broadcom Refused a CVE for a 16-Year-Old Wi-Fi Bug, and an Estimated 1.5 Million Belgian Routers Sit Unpatched

Someone parked across the street can take over a large share of Belgium's home routers without knowing the Wi-Fi password. Security researcher Quentin Kaiser found a bug in Broadcom's own Wi-Fi Protected Setup code, the feature that lets a device join a network without typing the key, and showed it running code as root on gateways from three of the country's four big internet providers.

The flaw has sat in Broadcom's SDK since at least 2010. Broadcom told Kaiser it has known about it since 2018, yet it refused to assign a CVE or speak publicly about it. Kaiser believes that silence is "probably the reason why so many OEMs did not patch."

A fix nobody shipped

According to Kaiser's full write-up, Broadcom silently released an incomplete patch in 2018, then a new SDK that swapped the vulnerable components for hostapd. Its advice to vendors was to move to that version. That makes the bug a definitive forever day on eCos-based chips (BCM3380, BCM3383, BCM33834) and a potential one on Linux platforms (BCM3390, BCM63xx, BCM65xx, BCM68xx), unless manufacturers do the migration.

The code fails to keep reassembled EAP-WPS fragments within the size of its destination buffer. It can be triggered over Wi-Fi without the network key and without finishing a normal WPS enrollment. Kaiser, who presented the work at Hexacon in Paris on October 16, says it touches dozens of vendors, hundreds of products and millions of access points worldwide.

He reported it to Broadcom in July. Broadcom answered that a patch is available and that affected manufacturers should contact it, then declined to register a CVE or share the notice it sent them. When Kaiser opened a case at CERT/CC on August 4, it closed the same day, because Broadcom is its own CVE Numbering Authority. The Hacker News found no CVE as of October 19.

Root shells over the air

The demos are blunt. On Orange Belgium's ASKEY TCG3000, Kaiser's shellcode pulled the Wi-Fi key out of memory, sent it back over the air, and he used it to join the network. On Proximus's BBOX3V+, he got a reverse shell carried over Wi-Fi frames, "so no need for a C2 in the cloud!" He warns the attack works over long distances.

VOO's Netgear CG3100 and CG3700, Technicolor 7210 and CGA4233 are on the list too. By Kaiser's own rough math, with medium confidence, that adds up to about 850,000 Proximus gateways, about 500,000 in VOO's legacy fleet and about 210,000 at Orange Belgium, roughly 1.56 million in total. As of October 15, every affected device he identified still lacked the patch. Telenet is not affected: its engineers checked their whole fleet for wps_monitor and found none.

So far the only working exploits are Kaiser's. No attacks in the wild have been reported.

Why it matters beyond Belgium

Kaiser says the bug suits nearest-neighbour attacks and hotel network compromises against devices defenders barely see, allowing traffic manipulation and collection. Russian state hackers have already breached networks over nearby Wi-Fi from across the street, and hotel networks are a favorite target: Russia-linked Midnight Blizzard went back into hotel Wi-Fi login pages two months after Microsoft exposed it.

He also notes how much faster the hunt has become. "Although I could have done this research by myself, it would have taken me months to get there. With AI frontier models it took me less than a week."

For owners of affected gear there is no patch to install and no known setting that blocks the attack over the air. Kaiser published a fingerprinting script that listens to a live access point and YARA rules that spot the vulnerable code in firmware, though both are triage tools and a patched device can still match. For hardware that will never be fixed, replacing it is the practical answer.

Some offers on this page may be paid placements or contain affiliate links.