A security researcher has demonstrated working exploits against a class of Wi-Fi gateways running Broadcom chips, showing that an attacker within radio range can gain root-level code execution on the device without knowing the Wi-Fi password or completing any kind of pairing process. As of this writing, no patch has been deployed to affected routers, and no CVE identifier has been assigned.
Quentin Kaiser published his findings on October 16, 2026, after a disclosure process that effectively went nowhere. The vulnerability sits inside Broadcom's own implementation of Wi-Fi Protected Setup, the handshake protocol designed to simplify connecting new devices to a network. Kaiser found that the code mishandles the reassembly of fragmented WPS messages. By sending carefully crafted fragments, an attacker can corrupt the device's memory and redirect execution, all through the air, from a position outside the building.
Two Working Exploits, Two Different Outcomes
Kaiser demonstrated the attack against two Belgian ISP-supplied gateways. On an Orange Belgium device, an Askey TCG3000, the exploit read the Wi-Fi pre-shared key directly from stored settings and transmitted it back to the attacker, effectively handing over the network password. On a Proximus gateway, the Sagemcom BBOX3V+, the exploit did something more severe: it opened a reverse shell transported entirely over Wi-Fi frames, without requiring the attacker to have an external server or any prior foothold on the network.
Both attacks required no credentials and no interaction from anyone inside the network. Distance helps the attacker, not the defender.
The Code Is Old, and So Is Broadcom's Awareness
The vulnerable code traces back to at least 2010. Broadcom issued a partial fix in 2018 and simultaneously told downstream customers to migrate to the hostapd Wi-Fi software package instead of relying on Broadcom's own WPS implementation. That guidance went unheeded across a large portion of the device ecosystem, and the underlying flaw was never fully resolved.
Kaiser says Broadcom was informed about the issue again through his disclosure process and declined to assign a CVE or comment publicly. CERT/CC, which typically coordinates vulnerability disclosures between researchers and vendors, closed his case the day it was opened, citing the fact that Broadcom holds its own CVE numbering authority.
The result is a vulnerability without an identifier, without a patch, and without any official acknowledgment from the company whose code is responsible.
Which Hardware Is Affected
Kaiser sorted the affected chips into two groups. Older eCos-based chips, the BCM3380, BCM3383, and BCM33834, cannot receive a practical fix given their architecture. He described these as a "forever day," meaning a vulnerability that will remain open for the functional life of the hardware. Newer Linux-based chips, including the BCM3390, BCM65xx, and BCM68xx series, are technically fixable if device makers choose to replace the WPS software stack.
Among confirmed deployments in Belgium, Proximus, Orange Belgium, and VOO gateways are affected. Kaiser was unable to test Telenet devices but considers them potentially in scope. His broader analysis, which involved automated firmware scanning, identified vulnerable code across Cisco small-business access points, Huawei gear, and ARRIS routers, among others. He estimates the total number of affected devices runs into the millions globally, though some entries in his published list are flagged as "likely vulnerable" rather than confirmed.
Detection Tools, but No Mitigation
For organizations trying to assess their exposure, Kaiser published YARA detection rules and a scanning script on GitHub at github.com/qkaiser/broadcom-wps. Both are intended as triage tools to identify firmware containing the vulnerable code. He notes that patched devices may still trigger the YARA rules, so a positive result requires additional verification rather than automatic remediation.
For devices that fall into the "forever day" category, the practical answer is replacement.
Why Proximity Attacks Are Getting More Attention
The threat model here matters beyond the technical details. Kaiser noted that this vulnerability is particularly useful to attackers who can position themselves in physical range of a target rather than approaching through the internet. That scenario is no longer theoretical.
In November 2024, Volexity documented how a Russian state-sponsored group, tracked as GruesomeLarch and linked to APT28, compromised organizations near a high-value target in Washington, D.C., and then used dual-homed systems inside those neighboring buildings to connect to the actual target's corporate Wi-Fi. The attacker never needed to be in the same room or even the same building. They just needed a wireless network with weak enough controls to reach from the street.
A flaw that lets anyone within radio range become root on the router, without a password, without a handshake, fits neatly into that playbook. The attack surface is wherever the signal reaches.
