A 2018 Broadcom Wi-Fi Fix Never Left the Lab

Broadcom quietly patched a critical Wi-Fi vulnerability in its router chipsets eight years ago. That fix, according to security researcher Quentin Kaiser, never made it into the firmware running on hundreds of millions of home gateways worldwide.

The breakdown exposes a structural failure in how hardware vendors manage end-of-life code and communicate risks through the global supply chain. Because Broadcom declined to request a Common Vulnerabilities and Exposures (CVE) identifier for the flaw—labeling the affected WPS code obsolete—the automated tracking systems used by internet service providers and router manufacturers to flag necessary updates never registered the threat.

Kaiser presented his findings at the Hexacon conference in Paris on October 16. He named the vulnerability WPSplinter precisely because no official CVE exists. The bug resides in Broadcom’s legacy implementation of Wi-Fi Protected Setup (WPS), the feature allowing users to connect devices by pressing a physical button rather than entering a password. Mishandled message exchanges within that code allow an attacker within radio range to read router memory or execute external commands without needing the Wi-Fi password or completing a WPS pairing.

This is distinct from the well-documented WPS PIN brute-force weaknesses publicized in the early 2010s. The issue here is specific to Broadcom’s proprietary codebase.

When Kaiser reported the vulnerability in July, Broadcom told him the company had known about it since 2018, had replaced the old WPS code in newer software releases, and directed him to contact device manufacturers directly. Kaiser stated that the 2018 patch applied to the legacy code was incomplete regardless.

The economic incentive structure for chipset makers heavily discourages retrofitting security fixes onto older silicon. Once a system-on-chip generation exits its commercial support window, vendors typically cease funding maintenance. Without a CVE, downstream OEMs like Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE, and Zyxel lack the standardized trigger required to allocate engineering resources toward backporting patches into legacy ISP gateway firmware.

Kaiser verified active exploitation paths on equipment supplied by three of Belgium’s four major ISPs: Proximus, Orange, and VOO. On an Askey TCG3000 gateway provided by Orange Belgium, his exploit extracted the Wi-Fi key directly from the device’s NVRAM over the air and used it to join the network. On a Sagemcom-manufactured Proximus BBOX3V+, he established a remote shell entirely over Wi-Fi without requiring an internet connection on his attacking machine. By his count, roughly 1.5 million vulnerable devices operate in Belgium alone.

Extrapolating from models deployed by ISPs including Movistar, Optus, KPN, and Türk Telekom, Kaiser estimates the global exposure reaches into the low hundreds of millions of units. He noted this tally remains incomplete.

Debate on Hacker News centered on whether ISPs bear ultimate responsibility for failing to push firmware updates. Kaiser argued that without a CVE, the warning likely never penetrated the supply chain’s patch pipelines. Changing a Wi-Fi password offers no protection, as the attack executes before authentication. Disabling WPS in the router settings is recommended, though Kaiser warned this may not fully deactivate the vulnerable Broadcom code.

For users operating ISP-supplied hardware with uncertain update histories, placing the gateway in bridge mode and routing traffic through a separate, up-to-date consumer router eliminates the local wireless attack surface. Kaiser published a detection script on GitHub for administrators checking their hardware.

He also disclosed that AI tools accelerated the discovery process significantly, locating the flaw in under a week—a task he estimated would have required months of manual reverse engineering. Router firmware historically benefited from obscurity and the sheer tedium of analysis. Automated tooling has removed both barriers.